@tencent-rtc/mcp@1.8.3
Tencent Cloud MCP Server for SDK
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package performs undisclosed runtime telemetry: it reports a persistent device identifier at startup and sends full prompts and answers to Tencent logging when relevant tools are used. This supports a warning for telemetry, but the observed endpoints belong to the package vendor and the reports are tied to its service and explicit tool use, so the evidence does not establish malicious behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Server startup reports configuration telemetry; invoking search_trtc_knowledge or finalize_answer reports prompts and answers.
Impact
The service receives a stable device identifier that can encode host and username details, as well as consultation content that may contain sensitive information.
Mechanism
The package derives a fallback SDKAppID from a stored device identifier, reports it at startup, and maps prompt and answer fields into telemetry requests.
AI rationale
The package performs undisclosed runtime telemetry: it reports a persistent device identifier at startup and sends full prompts and answers to Tencent logging when relevant tools are used. This supports a warning for telemetry, but the observed endpoints belong to the package vendor and the reports are tied to its service and explicit tool use, so the evidence does not establish malicious behavior.
Evidence
server-config.jsutils/get-device-identifier.jsutils/report-es-client.jsutils/report-cls-client.jstools/common/search_trtc_knowledge.jstools/common/finalize_answer.js~/.mcp/identifier
Network endpoints2
ap-nanjing.cls.tencentcs.comwebim.tim.qq.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- On server startup, missing or invalid SDKAPPID is replaced with a device identifier, then reported as mcp_config.
- The fallback identifier is derived from host, platform, architecture, and username information.
- When search_trtc_knowledge is called, the original prompt is sent to the CLS reporting function; that function posts telemetry to ap-nanjing.cls.tencentcs.com.
- When finalize_answer is called, the answer and prompt are sent to the same reporting function.
Evidence against
- The package presents itself as a Tencent RTC documentation retrieval and integration MCP server, and its local chunker source performs text segmentation.
- The manifest contains no lifecycle scripts; prompt and answer reports are triggered by explicit tool calls, while the startup report carries configuration telemetry.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgknowledge/chunker.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tencent-rtc/mcp@1.7.8
matchedIdentity = npm:QHRlbmNlbnQtcnRjL21jcA:1.7.8
similarity = 0.480
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
knowledge/chunker.jsView on unpkgserver-config.jsView file
Findings
1 Critical1 High7 Medium3 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltaknowledge/chunker.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidenceserver-config.js
MediumAi Review Evidenceserver-config.js
MediumAi Review Evidenceutils/get-device-identifier.js
MediumAi Review Evidencetools/common/search_trtc_knowledge.js
MediumAi Review Evidenceutils/report-cls-client.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tencent-rtc/mcp@1.8.3.
See all versions of @tencent-rtc/mcp for other recorded verdicts.
- Review the evidence and your use of @tencent-rtc/mcp@1.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.