@roarkanalytics/sdk-mcp@4.9.0
The official MCP Server for the Roark API
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe configurable instruction endpoint forwards an existing credential without an allowlist, which is a concrete conditional credential-forwarding risk. The inspected manifest has no lifecycle hook or other active malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting the MCP server while a Stainless key and the instruction-endpoint environment setting are present.
Impact
An operator-configured untrusted endpoint could receive the Stainless credential.
Mechanism
The instruction request uses the configured URL and places the existing Stainless key in its authorization header without destination validation.
AI rationale
The configurable instruction endpoint forwards an existing credential without an allowlist, which is a concrete conditional credential-forwarding risk. The inspected manifest has no lifecycle hook or other active malicious chain.
Evidence
instructions.js
Network endpoints1
api.stainless.com/api/ai/instructions/roark-analytics
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest has no npm lifecycle hook; its listed scripts are development commands.
- Both CommonJS and ESM builds expose an execute MCP tool.
- The TypeScript source implements a local Deno execution handler.
- The worker evaluates supplied TypeScript through a data-module import.
- Instruction retrieval permits an environment-selected endpoint and forwards a Stainless authorization value.
- Local documentation search constructs in-memory MiniSearch indexes.
Evidence against
- No automatic install-time execution was found.
- The credential forwarding is conditional on a configured endpoint and a supplied Stainless key.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = plumery-mcp@3.9.0
matchedPath = instructions.js
matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
52Source sends the broad process environment to a literal external destination.
L52: interfaceType: 'PHONE',
L53: recordingUrl: 'https://example.com',
L54: startedAt: 'startedAt',
...
L155: },
L156: body: JSON.stringify({
L157: project_name: 'roark-analytics',
...
L166: }
L167: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L168: }
...
L214: // Check if deno is in PATH
L215: const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L216: try {
Findings
2 Critical8 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
HighPrevious Version Dangerous Deltacode-tool-worker.js
MediumDynamic Requireinstructions.js
Affected versions and remediation
This report applies to @roarkanalytics/sdk-mcp@4.9.0.
See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @roarkanalytics/sdk-mcp@4.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.