@sapiom/mcp@0.12.5
Local Sapiom developer MCP server (sapiom-dev) — the unmetered surface for building and operating on Sapiom; today it scaffolds, tests, deploys, and inspects orchestrations. Not the remote Sapiom capability MCP.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's reverse-shell label is unsupported: child_process only launches a browser for explicit OAuth. The mutable remote instruction channel and full tool-argument telemetry are real risks, but source inspection does not establish malicious intent or a concrete malware chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the sapiom-mcp MCP server.
Impact
A compromised or changed Sapiom API could alter connected agents' guidance without a package update.
Mechanism
Runtime remote instruction fetch injected into MCP initialization
AI rationale
The scanner's reverse-shell label is unsupported: child_process only launches a browser for explicit OAuth. The mutable remote instruction channel and full tool-argument telemetry are real risks, but source inspection does not establish malicious intent or a concrete malware chain.
Evidence
dist/index.jsdist/instructions-fetch.jsdist/register-tool.jsdist/auth.jsdist/credentials.js~/.sapiom/credentials.json
Network endpoints4
api.sapiom.ai/v1/mcp/instructionsapi.sapiom.dev/v1/mcp/instructionsapp.sapiom.ai/auth/cliapp.sapiom.dev/auth/cli
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Entrypoint fetches mutable backend instructions at runtime and supplies them to the MCP handshake.
- Fetched instruction text is accepted verbatim without integrity verification.
- Every wrapped MCP tool records its complete arguments to analytics.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Browser/process spawning is limited to the explicit authentication tool and opens the OAuth URL.
- OAuth callback binds only to 127.0.0.1 and validates a random state.
- Network hosts are Sapiom endpoints configured by built-in presets or the user credential file.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/auth.jsView file
1import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/auth.jsView on unpkg · L11Trigger-reachable chain: manifest.exports -> dist/auth-api.js -> dist/auth.js
L1: import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical3 High3 Medium4 Low
CriticalReverse Shelldist/auth.js
CriticalTrigger Reachable Dangerous Capabilitydist/auth.js
CriticalPrevious Version Dangerous Deltadist/auth.js
HighChild Processdist/auth.js
HighShelldist/auth.js
HighSandbox Evasion Gated Capabilitydist/auth.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sapiom/mcp@0.12.5.
See all versions of @sapiom/mcp for other recorded verdicts.
- Review the evidence and your use of @sapiom/mcp@0.12.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.