@tencent-rtc/mcp@1.8.0
Tencent Cloud MCP Server for SDK
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source shows runtime reporting of user prompts and a persistent or host/user-derived identifier to Tencent logging services, with no evident disclosure or opt-out. This is suspicious telemetry; the inspected flow does not show the secret key being sent.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
MCP server startup sends configuration telemetry; invoking knowledge search sends the prompt and related metadata.
Impact
Tencent logging endpoints receive user prompts and identifying telemetry without an evident disclosure or opt-out.
Mechanism
The package posts SDKAppID and a persistent or host/user-derived identifier, and separately posts prompt text and reporting metadata.
AI rationale
The source shows runtime reporting of user prompts and a persistent or host/user-derived identifier to Tencent logging services, with no evident disclosure or opt-out. This is suspicious telemetry; the inspected flow does not show the secret key being sent.
Evidence
index.jsserver-config.jsutils/get-device-identifier.jsutils/report-es-client.jsutils/report-cls-client.jstools/common/search_trtc_knowledge.js~/.mcp/identifier
Network endpoints2
webim.tim.qq.com/v4/imopenstat/tim_web_report?sdkappid=${SDKAppID}&reqtime=${Math.floor(time / 1000)}ap-nanjing.cls.tencentcs.com/tracklog?topic_id=a1310e66-a3f5-4572-a1c3-7a327a27496d
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI initializes ServerConfig on startup, which reports the configured or generated SDKAppID.
- The fallback device identifier can be derived from the hostname and OS username.
- A knowledge-search tool forwards the user's prompt to runtime reporting.
- The reporting payload includes prompt text and a device identifier, and is posted to Tencent logging endpoints.
Evidence against
- The manifest has no install or lifecycle scripts.
- The package is presented as a Tencent RTC MCP server, and the reporting hosts are Tencent domains.
- The inspected reporting flow does not show SECRETKEY being sent.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgknowledge/chunker.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tencent-rtc/mcp@1.7.8
matchedIdentity = npm:QHRlbmNlbnQtcnRjL21jcA:1.7.8
similarity = 0.480
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
knowledge/chunker.jsView on unpkgindex.jsView file
9
Findings
1 Critical1 High7 Medium3 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltaknowledge/chunker.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceserver-config.js
MediumAi Review Evidenceutils/get-device-identifier.js
MediumAi Review Evidencetools/common/search_trtc_knowledge.js
MediumAi Review Evidenceutils/report-cls-client.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tencent-rtc/mcp@1.8.0.
See all versions of @tencent-rtc/mcp for other recorded verdicts.
- Review the evidence and your use of @tencent-rtc/mcp@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.