registry / @speakai/mcp-server / 1.13.4

@speakai/mcp-server@1.13.4

Official Speak AI MCP Server — capture meetings, search thousands of recordings, run async voice and video surveys, create clips, and automate workflows from your AI assistant.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 251 KB of source, external domains: api.speakai.co, app.speakai.co

Source & flagged code

2 flagged

dist/index.jsView file

Lines 17-57javascript

17 if (from && typeof from === "object" || typeof from === "function") {

18 for (let key of __getOwnPropNames(from))

19 if (!__hasOwnProp.call(to, key) && key !== except)

20 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

21 }

22 return to;

23};

24var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

25 // If the importer is in node compatibility mode or this is not an ESM

26 // file that has been converted to a CommonJS file using a Babel-

27 // compatible transform (i.e. "__esModule" has not been set), then set

28 // "default" to the CommonJS "module.exports" for node compatibility.

29 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

30 mod

31));

32var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

34// src/client.ts

35var client_exports = {};

36__export(client_exports, {

37 createSpeakClient: () => createSpeakClient,

38 formatAxiosError: () => formatAxiosError,

39 speakClient: () => speakClient

40});

41function getBaseUrl() {

42 return process.env.SPEAK_BASE_URL ?? "https://api.speakai.co";

43}

44function getApiKey() {

45 return process.env.SPEAK_API_KEY ?? "";

46}

47async function authenticate() {

48 const apiKey = getApiKey();

49 if (!apiKey) {

50 throw new Error("SPEAK_API_KEY is not set. Run 'speakai-mcp config set-key' or set the environment variable.");

51 }

52 try {

53 const res = await import_axios.default.post(

54 `${getBaseUrl()}/v1/auth/accessToken`,

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L37

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L37

55 {},

56 {

57 headers: {

Source & flagged code

2 flagged · loading source

dist/index.jsView file

37createSpeakClient: () => createSpeakClient, L38: formatAxiosError: () => formatAxiosError, L39: speakClient: () => speakClient ... L41: function getBaseUrl() { L42: return process.env.SPEAK_BASE_URL ?? "https://api.speakai.co"; L43: } ... L52: try { L53: const res = await import_axios.default.post( L54: `${getBaseUrl()}/v1/auth/accessToken`, ... L66: tokenExpiresAt = Date.now() + 50 * 60 * 1e3; L67: process.stderr.write("[speakai-mcp] Authenticated successfully\n"); L68: }

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L37

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L37

Findings

2 High3 Medium5 Low

HighCredential Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 17-57javascript

17 if (from && typeof from === "object" || typeof from === "function") {

18 for (let key of __getOwnPropNames(from))

19 if (!__hasOwnProp.call(to, key) && key !== except)

20 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

21 }

22 return to;

23};

24var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

25 // If the importer is in node compatibility mode or this is not an ESM

26 // file that has been converted to a CommonJS file using a Babel-

27 // compatible transform (i.e. "__esModule" has not been set), then set

28 // "default" to the CommonJS "module.exports" for node compatibility.

29 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

30 mod

31));

32var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

34// src/client.ts

35var client_exports = {};

36__export(client_exports, {

37 createSpeakClient: () => createSpeakClient,

38 formatAxiosError: () => formatAxiosError,

39 speakClient: () => speakClient

40});

41function getBaseUrl() {

42 return process.env.SPEAK_BASE_URL ?? "https://api.speakai.co";

43}

44function getApiKey() {

45 return process.env.SPEAK_API_KEY ?? "";

46}

47async function authenticate() {

48 const apiKey = getApiKey();

49 if (!apiKey) {

50 throw new Error("SPEAK_API_KEY is not set. Run 'speakai-mcp config set-key' or set the environment variable.");

51 }

52 try {

53 const res = await import_axios.default.post(

54 `${getBaseUrl()}/v1/auth/accessToken`,

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L37

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L37

55 {},

56 {

57 headers: {