registry / @sapiom/mcp / 0.20.2
@sapiom/mcp@0.20.2
⚠ Under reviewLocal Sapiom developer MCP server (sapiom-dev) — the unmetered surface for building and operating on Sapiom; today it scaffolds, tests, deploys, and inspects orchestrations. Not the remote Sapiom capability MCP.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package hands a saved API key to an analytics dependency whose implementation is unavailable in this snapshot, so recipient and consent enforcement cannot be resolved. The reverse-shell hint resolves to browser launching for explicit OAuth authentication, and no attack was confirmed; manual review is appropriate for the unresolved dependency behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
MCP server startup configures analytics; each registered tool call emits an event.
Impact
Possible disclosure of the saved key or tool arguments is unresolved; no disclosure was confirmed.
Mechanism
The package passes the cached key to the analytics constructor and tool arguments to its tracking method. The dependency’s handling, collector, and opt-out enforcement could not be verified.
AI rationale
The package hands a saved API key to an analytics dependency whose implementation is unavailable in this snapshot, so recipient and consent enforcement cannot be resolved. The reverse-shell hint resolves to browser launching for explicit OAuth authentication, and no attack was confirmed; manual review is appropriate for the unresolved dependency behavior.
Evidence
package.jsondist/server.jsdist/analytics.jsdist/register-tool.js
Decision evidence
public snapshotAI called this Manual Review at 87.0% confidence as Unknown with medium false-positive risk.
AI review observations
- At startup, the server passes its cached API key to the analytics wrapper, which passes it to @sapiom/analytics-core. The manifest declares that dependency, but its source is absent from this snapshot, so the key’s handling and recipient remain unresolved.
- Each tool call records its arguments and sends an event through the analytics track API; the package describes telemetry as live by default with an endpoint override, but the dependency source needed to verify transmission and opt-out behavior is unavailable.
- The flagged child-process code launches a platform browser for authentication. The authenticate tool exchanges a browser login result and stores the returned key for the selected environment.
Evidence against
- No confirmed credential transmission, unrelated recipient, or attack was established from the inspected source.
- The browser authentication flow and credential storage are consistent with the package’s stated Sapiom login purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
5 flaggeddist/auth.jsView file
1import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/auth.jsView on unpkg · L11Trigger-reachable chain: manifest.exports -> dist/auth-api.d.ts -> dist/auth.js
L1: import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 High3 Medium4 Low
CriticalReverse Shelldist/auth.js
CriticalTrigger Reachable Dangerous Capabilitydist/auth.js
HighChild Processdist/auth.js
HighSandbox Evasion Gated Capabilitydist/auth.js
HighSemantic Analysis Limiteddist/tools/app-manage.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sapiom/mcp@0.20.2.
See all versions of @sapiom/mcp for other recorded verdicts.
- Review the evidence and your use of @sapiom/mcp@0.20.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.