@tencentcloud/sdk-mcp@1.8.7
Tencent Cloud MCP Server for SDK
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package reports prompts and response-related content alongside a persistent device identifier to Tencent endpoints without an evident disclosure or runtime opt-out. This is suspicious runtime telemetry, though the endpoints belong to Tencent and the prompts are used by the package’s documentation-search feature.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Server startup reports configuration; using search or integration tools triggers additional reports.
Impact
Tencent receives user query content and a persistent, potentially identifying device token during normal use.
Mechanism
Reporting code places prompt and response-related fields plus a device identifier in HTTPS POST requests to Tencent endpoints. The fallback identifier is derived from hostname and username.
AI rationale
The package reports prompts and response-related content alongside a persistent device identifier to Tencent endpoints without an evident disclosure or runtime opt-out. This is suspicious runtime telemetry, though the endpoints belong to Tencent and the prompts are used by the package’s documentation-search feature.
Evidence
server-config.jsutils/report-cls-client.jsutils/report-es-client.jsutils/get-device-identifier.jstools/common/search_trtc_knowledge.js~/.mcp/identifier
Network endpoints2
ap-nanjing.cls.tencentcs.comwebim.tim.qq.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The stdio server initializes ServerConfig on startup, which triggers a configuration report.
- Runtime reports include prompts, answers or feedback, and a device identifier.
- The report sends those fields to Tencent’s CLS endpoint; the fallback identifier is derived from hostname and username.
- The new chunker source handles Markdown tables and paragraphs; its reviewed code showed no network or environment access.
Evidence against
- The package is a Tencent Cloud MCP server, and its search feature uses user prompts to retrieve Tencent RTC documentation.
- The manifest declares no lifecycle scripts; the reporting path runs at runtime.
- Successful server startup reporting is commented out.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgknowledge/chunker.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tencentcloud/sdk-mcp@1.7.8
matchedIdentity = npm:QHRlbmNlbnRjbG91ZC9zZGstbWNw:1.7.8
similarity = 0.493
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
knowledge/chunker.jsView on unpkgserver-config.jsView file
Findings
1 Critical1 High7 Medium3 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltaknowledge/chunker.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidenceserver-config.js
MediumAi Review Evidenceutils/report-cls-client.js
MediumAi Review Evidenceutils/report-cls-client.js
MediumAi Review Evidenceutils/get-device-identifier.js
MediumAi Review Evidenceindex.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tencentcloud/sdk-mcp@1.8.7.
See all versions of @tencentcloud/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @tencentcloud/sdk-mcp@1.8.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.