@sapiom/mcp
Local Sapiom developer MCP server (sapiom-dev) — the unmetered surface for building and operating on Sapiom; today it scaffolds, tests, deploys, and inspects orchestrations. Not the remote Sapiom capability MCP.
This report shows the evidence for @sapiom/mcp@0.20.4. 0 of 25 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 19h ago · by lpm-firewall-aiThe reverse-shell and dangerous-capability flags are false positives: the process launcher opens a browser for a user-invoked OAuth flow, and its callback is bound to loopback. Startup analytics is enabled by default and has source-documented opt-outs, but was not disclosed in the README, so this is a telemetry warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the MCP server.
Impact
Usage data may be sent to Sapiom without users seeing disclosure in the package README; users can disable telemetry with the documented environment variables.
Mechanism
The server configures an analytics emitter at startup, passing a cached Sapiom API key when available. Source comments identify the hosted collector and opt-out variables; analytics payload details are in the dependency implementation, which was not available for this review.
AI rationale
The reverse-shell and dangerous-capability flags are false positives: the process launcher opens a browser for a user-invoked OAuth flow, and its callback is bound to loopback. Startup analytics is enabled by default and has source-documented opt-outs, but was not disclosed in the README, so this is a telemetry warning rather than a block.
Evidence
dist/server.jsdist/analytics.js~/.sapiom/credentials.json~/.sapiom/mcp-instructions-cache-*.json
Network endpoints2
api.sapiom.aiSAPIOM_ANALYTICS_ENDPOINT (configurable)
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Server startup enables usage analytics by default and documents opt-out variables in source comments.
- The package’s main entry starts the MCP server; startup configures analytics using any cached Sapiom API key.
- The authentication process launcher is used by an explicitly invoked authentication tool and opens the browser.
- Browser authentication listens on a random loopback port and exchanges the returned code with the configured Sapiom API host.
Evidence against
- No install lifecycle scripts are declared.
- The flagged child-process use launches the system browser; it does not implement a reverse shell.
- The authentication tool is described as a browser login flow and writes the resulting Sapiom credentials to the shared credential store.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/auth.jsView file
1import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/auth.jsView on unpkg · L11Trigger-reachable chain: manifest.exports -> dist/auth-api.d.ts -> dist/auth.js
L1: import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 High3 Medium4 Low
CriticalReverse Shelldist/auth.js
CriticalTrigger Reachable Dangerous Capabilitydist/auth.js
HighChild Processdist/auth.js
HighSandbox Evasion Gated Capabilitydist/auth.js
HighSemantic Analysis Limiteddist/tools/app-manage.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sapiom/mcp@0.20.4.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @sapiom/mcp@0.20.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.