registry / @sapiom/mcp / 0.20.1
@sapiom/mcp@0.20.1
Local Sapiom developer MCP server (sapiom-dev) — the unmetered surface for building and operating on Sapiom; today it scaffolds, tests, deploys, and inspects orchestrations. Not the remote Sapiom capability MCP.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe source inspection found no install hook or concrete attack behavior. Scanner findings correspond to browser OAuth, project scanning, and explicitly invoked App Link management.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes authentication or an App Link management tool.
Impact
The reviewed behavior does not establish unauthorized execution, credential disclosure, or agent configuration changes.
Mechanism
Authentication opens the resolved Sapiom login URL and exchanges its authorization code with the resolved API. App Link settings use the requested fields; deletion checks for confirmation.
AI rationale
The source inspection found no install hook or concrete attack behavior. Scanner findings correspond to browser OAuth, project scanning, and explicitly invoked App Link management.
Evidence
package.jsondist/auth.jsdist/tools/authenticate.jsdist/credentials.jsdist/map/scan-project.jsdist/tools/app-manage.js
Network endpoints2
api.sapiom.aiapi.sapiom.dev
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the MCP server entrypoint and lists build and start scripts; no install lifecycle hook is present in the manifest.
- The scanner skips `.claude` and writes Git blobs beneath its supplied destination, rather than modifying agent configuration.
- The flagged process launch opens the browser for authentication; the authentication tool passes the resolved Sapiom app and API URLs to that flow.
- The token exchange sends an authorization code to the resolved API URL; production and staging defaults are Sapiom endpoints.
- App Link settings are changed through an explicit tool call, and deletion requires `confirm: true`.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/auth.jsView file
1import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/auth.jsView on unpkg · L11Trigger-reachable chain: manifest.exports -> dist/auth-api.d.ts -> dist/auth.js
L1: import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 High3 Medium4 Low
CriticalReverse Shelldist/auth.js
CriticalTrigger Reachable Dangerous Capabilitydist/auth.js
HighChild Processdist/auth.js
HighSandbox Evasion Gated Capabilitydist/auth.js
HighSemantic Analysis Limiteddist/tools/app-manage.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sapiom/mcp@0.20.1.
See all versions of @sapiom/mcp for other recorded verdicts.
- Review the evidence and your use of @sapiom/mcp@0.20.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.