@tencentcloud/sdk-mcp@1.8.3
Tencent Cloud MCP Server for SDK
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package performs undisclosed runtime reporting of user prompts and answer or feedback data to a Tencent analytics endpoint, beyond the data needed to provide its knowledge lookup feature. This is suspicious telemetry; the source does not show credential theft or another concrete attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the server reports basic configuration; invoking knowledge search or other reporting tools sends their associated data.
Impact
User queries and associated response data may be collected by Tencent without disclosure or an opt-out in the inspected code.
Mechanism
The reporting client posts prompt, answer or feedback, query ID, product details, and device identifier to ap-nanjing.cls.tencentcs.com. Startup configuration is also reported to webim.tim.qq.com.
AI rationale
The package performs undisclosed runtime reporting of user prompts and answer or feedback data to a Tencent analytics endpoint, beyond the data needed to provide its knowledge lookup feature. This is suspicious telemetry; the source does not show credential theft or another concrete attack.
Evidence
server-config.jsutils/report-cls-client.jstools/common/search_trtc_knowledge.jsutils/get-device-identifier.js~/.mcp/identifier
Network endpoints2
ap-nanjing.cls.tencentcs.comwebim.tim.qq.com
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package starts a Tencent RTC MCP server and has no lifecycle scripts in its manifest.
- Server initialization reports configuration to Tencent's webim.tim.qq.com endpoint using the SDK app ID or a generated device identifier.
- Knowledge-search tool calls send user prompts, answers or feedback, and a persistent device identifier to ap-nanjing.cls.tencentcs.com.
- The prompt and response reporting is not disclosed in the inspected server instructions, and no opt-out was found.
Evidence against
- The manifest describes a Tencent Cloud MCP server, and its entry point starts that server over stdio.
- Knowledge lookup and integration generation are the package's stated functions; their requested inputs are used by those tools.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg1{
"name": "@tencentcloud/sdk-mcp",
"version": "1.8.3",
"description": "Tencent Cloud MCP Server for SDK",
"type": "module",
"main": "index.js",
"bin": "index.
Medium
Suspicious Lifecycle Evidence
The package starts a Tencent RTC MCP server and has no lifecycle scripts in its manifest.
package.jsonView on unpkg · L1knowledge/chunker.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tencentcloud/sdk-mcp@1.7.8
matchedIdentity = npm:QHRlbmNlbnRjbG91ZC9zZGstbWNw:1.7.8
similarity = 0.493
summary = stored previous version shares package body but lacks this dangerous source file
High
Findings
1 Critical1 High7 Medium3 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltaknowledge/chunker.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceserver-config.js
MediumAi Review Evidencetools/common/search_trtc_knowledge.js
MediumAi Review Evidenceutils/report-cls-client.js
MediumAi Review Evidenceutils/report-cls-client.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tencentcloud/sdk-mcp@1.8.3.
See all versions of @tencentcloud/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @tencentcloud/sdk-mcp@1.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.