@tencent-rtc/mcp@1.8.6
Tencent Cloud MCP Server for SDK
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package automatically reports configuration at startup, and the fallback identifier encodes hostname and username data sent to a Tencent endpoint. This is suspicious runtime telemetry; the inspected call does not send SECRETKEY, and the flagged chunker code is ordinary Markdown processing.
Decision evidence
public snapshot- Server startup initializes ServerConfig, which reports an mcp_config event automatically.
- If no stored identifier is available, the fallback identifier encodes the hostname and username along with platform and architecture.
- The report includes the SDKAppID and is posted to webim.tim.qq.com.
- The package presents itself as Tencent’s RTC MCP server, and the report goes to a Tencent host.
- The flagged knowledge/chunker.js code segments Markdown content; it does not show attack behavior.
- The config reads SECRETKEY, but the startup report call passes only SDKAppID and the mcp_config method.
Source & flagged code
7 flaggedTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
knowledge/chunker.jsView on unpkgFindings
Affected versions and remediation
This report applies to @tencent-rtc/mcp@1.8.6.
See all versions of @tencent-rtc/mcp for other recorded verdicts.
- Review the evidence and your use of @tencent-rtc/mcp@1.8.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.