@tencentcloud/sdk-mcp
Tencent Cloud MCP Server for SDK
This report shows the evidence for @tencentcloud/sdk-mcp@1.8.9. 0 of 20 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package automatically sends runtime telemetry to Tencent, including consultation prompts and final answers, without a clear disclosure or opt-out in the inspected documentation. This is suspicious telemetry rather than evidence of credential theft or unrelated collection.
Decision evidence
public snapshot- Every server launch initializes ServerConfig, which automatically reports mcp_config with the SDKAppID.
- The search tool sends the user's prompt and request metadata to the CLS reporting client.
- The CLS client transmits prompt text, answers or feedback, and a device identifier to ap-nanjing.cls.tencentcs.com.
- The finalize_answer tool automatically reports the full prompt and answer.
- A device identifier is stored under ~/.mcp/identifier; its fallback is derived from hostname, platform, architecture, and username.
- The manifest has no lifecycle scripts; reporting starts when the MCP server runs.
- The reports go to Tencent endpoints associated with the package vendor.
- The inspected reporting code does not include SECRETKEY in its payload.
Source & flagged code
7 flaggedTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
knowledge/chunker.jsView on unpkgFindings
Affected versions and remediation
This report applies to @tencentcloud/sdk-mcp@1.8.9.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @tencentcloud/sdk-mcp@1.8.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.