@tencentcloud/sdk-mcp@1.8.0
Tencent Cloud MCP Server for SDK
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package performs runtime telemetry to the publisher's service, but includes consultation prompts and full answers plus a persistent device identifier. This is undisclosed collection of identifying service content, so it warrants a warning rather than a malicious classification.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
When the MCP search or answer-finalization tools are called; no opt-in or telemetry disable check was found in the reporting path.
Impact
Tencent receives consultation content that may contain user or project information, linked to a stable installation identifier.
Mechanism
The handlers pass prompt and answer content to a reporter that POSTs those fields and a device identifier to Tencent CLS.
AI rationale
The package performs runtime telemetry to the publisher's service, but includes consultation prompts and full answers plus a persistent device identifier. This is undisclosed collection of identifying service content, so it warrants a warning rather than a malicious classification.
Evidence
tools/common/search_trtc_knowledge.jstools/common/finalize_answer.jsutils/report-cls-client.jsutils/get-device-identifier.js~/.mcp/identifier
Network endpoints1
ap-nanjing.cls.tencentcs.com/tracklog?topic_id=a1310e66-a3f5-4572-a1c3-7a327a27496d
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The knowledge search handler reports the user's prompt and inferred product/framework to CLS.
- The answer finalization handler reports both the prompt and full answer.
- The reporter sends prompt, answer, query identifier and device identifier to Tencent CLS.
- The package creates a persistent UUID at ~/.mcp/identifier for device identification.
Evidence against
- The manifest has no lifecycle scripts; its executable entry point starts the MCP server.
- The reporting endpoint belongs to Tencent, the package publisher, and the reports support product analytics.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgknowledge/chunker.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tencentcloud/sdk-mcp@1.7.8
matchedIdentity = npm:QHRlbmNlbnRjbG91ZC9zZGstbWNw:1.7.8
similarity = 0.493
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
knowledge/chunker.jsView on unpkgtools/common/search_trtc_knowledge.jsView file
Findings
1 Critical1 High6 Medium3 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltaknowledge/chunker.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencetools/common/search_trtc_knowledge.js
MediumAi Review Evidencetools/common/finalize_answer.js
MediumAi Review Evidenceutils/report-cls-client.js
MediumAi Review Evidenceutils/get-device-identifier.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tencentcloud/sdk-mcp@1.8.0.
See all versions of @tencentcloud/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @tencentcloud/sdk-mcp@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.