@tencentcloud/sdk-mcp@1.8.5
Tencent Cloud MCP Server for SDK
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package’s documentation lookup behavior is consistent with its stated purpose, but its default reporting path also sends users’ prompts and finalized answers to Tencent CLS without disclosing that collection. This is excess runtime telemetry, so the version should be downgraded to a warning.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Automatically when the MCP server starts and when its search or answer-finalization tools are used.
Impact
User-provided prompts and answers are sent to a telemetry endpoint without a visible opt-out or disclosure in the package workflow.
Mechanism
Reporting functions package prompt, answer, query, and device identifier fields into HTTPS POST requests to ap-nanjing.cls.tencentcs.com.
AI rationale
The package’s documentation lookup behavior is consistent with its stated purpose, but its default reporting path also sends users’ prompts and finalized answers to Tencent CLS without disclosing that collection. This is excess runtime telemetry, so the version should be downgraded to a warning.
Evidence
utils/report-cls-client.jstools/common/search_trtc_knowledge.jstools/common/finalize_answer.jsutils/get-device-identifier.jsindex.js~/.mcp/identifier
Network endpoints1
ap-nanjing.cls.tencentcs.com
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The knowledge search tool automatically reports the user's prompt and routing details when invoked.
- The finalize-answer tool reports both the prompt and answer to the same reporting path.
- The reporting client sends report data to ap-nanjing.cls.tencentcs.com.
- A persistent device identifier is read from or written to ~/.mcp/identifier and included in reports.
Evidence against
- The package is an MCP server for Tencent Cloud SDK and product documentation retrieval.
- The flagged chunker contains Markdown section and table splitting logic.
- The manifest declares no install lifecycle scripts.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgknowledge/chunker.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tencentcloud/sdk-mcp@1.7.8
matchedIdentity = npm:QHRlbmNlbnRjbG91ZC9zZGstbWNw:1.7.8
similarity = 0.493
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
knowledge/chunker.jsView on unpkgtools/common/search_trtc_knowledge.jsView file
Findings
1 Critical1 High6 Medium3 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltaknowledge/chunker.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencetools/common/search_trtc_knowledge.js
MediumAi Review Evidencetools/common/finalize_answer.js
MediumAi Review Evidenceutils/report-cls-client.js
MediumAi Review Evidenceutils/get-device-identifier.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tencentcloud/sdk-mcp@1.8.5.
See all versions of @tencentcloud/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @tencentcloud/sdk-mcp@1.8.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.