registry / @trustbaseai/collab-mcp / 0.2.1

@trustbaseai/collab-mcp@0.2.1

Multi-AI collaboration MCP server - core communication layer

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The default network service listens on all IPv4 interfaces. Its auth middleware marks `/` public, while the server treats POST `/` as an MCP RPC endpoint that invokes database-backed tools.

Static reason

One or more suspicious static signals were detected.

Trigger

Run `collab-mcp start` or import `src/index.js`; a remote client POSTs JSON-RPC to `/`.

Impact

Unauthenticated network clients can read or alter collaboration data and invoke commit synchronization; supplied credentials may also be written to server logs on protected routes.

Mechanism

authentication bypass for MCP tool invocation

Rationale

Source inspection confirms a remotely reachable authentication bypass and credential-bearing debug logging, so the package is unsafe to publish without remediation. No install-time execution, exfiltration, or stealth persistence establishes malicious intent.

Evidence

package.jsonsrc/config-store.jssrc/auth.jssrc/server.jssrc/tools.jssrc/database.jssrc/cli-autostart.jssrc/service-linux.jssrc/service-windows.jssrc/index.js~/.collab-mcp/config.json~/.collab-mcp/collab.db

Network endpoints1

0.0.0.0:3010/

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`src/auth.js` exempts `/` from authentication.
`src/server.js` accepts unauthenticated POST `/` as MCP JSON-RPC.
`src/tools.js` exposes message, review, target, and commit-sync handlers.
`src/config-store.js` defaults to `0.0.0.0:3010` with auth enabled.
`src/auth.js` logs Authorization and X-API-Key header values when auth is checked.
`src/database.js` runs git metadata collection for caller-controlled project roots.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
Service persistence is only behind explicit `collab-mcp autostart enable`.
No external network endpoint or credential-exfiltration path was found.
Shell execution is limited to a fixed `git log` command and OS-service helpers.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 92.0 KB of source, external domains: 127.0.0.1, schemas.microsoft.com, www.launchd.info

Source & flagged code

4 flagged

src/cli-install.jsView file

Lines 94-134javascript

94 } else {

95 try {

96 const u = await prompt('Admin username [admin]: ');

97 username = (u || 'admin').trim();

98 password = await prompt('Admin password (empty = random): ');

99 } catch (_) {

100 // readline blew up (rare); fall back to random

101 password = crypto.randomBytes(16).toString('base64url');

102 console.log('✓ Interactive prompt failed → generated random admin password');

103 }

104 if (!password) {

105 password = crypto.randomBytes(16).toString('base64url');

106 console.log('✓ Generated random admin password');

107 }

108 }

109

110 try {

111 const hash = await auth.hashPassword(password);

112 db.createUser({ username, password_hash: hash, role: 'admin' });

113 console.log('✓ Created admin user: ' + username);

114 console.log(' password: ' + password);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

115 console.log(' (change with: collab-mcp user passwd ' + username + ')');

116 } catch (e) {

117 console.error('✗ Failed to create admin user:', e.message);

118 db.close();

119 return 1;

120 }

121 }

122

123 // 5. Admin API key (DB-backed, replaces Phase 1 configStore.api_keys.admin)

124 const existingAdminKeys = db.listApiKeys().filter((k) => k.name === 'admin' && !k.revoked);

125 if (existingAdminKeys.length > 0) {

126 console.log('• admin API key already exists (use `collab-mcp keys list` to view)');

127 } else {

128 const id = 'cmcp_' + crypto.randomBytes(16).toString('hex');

129 const secret = crypto.randomBytes(32).toString('base64url');

130 const hash = await auth.hashPassword(secret);

131 try {

132 db.createApiKey({

133 id,

134 name: 'admin',

src/service-windows.jsView file

Lines 1-32javascript

1'use strict';

3/**

4 * service-windows.js - Windows service installer

5 *

6 * Strategy:

7 * 1. Write a .bat wrapper at ~/.collab-mcp/bin/service-start.bat

8 * 2. Try sc.exe create (requires admin). If that fails, fall back to a

9 * Logon-triggered Scheduled Task (no admin required).

10 * 3. uninstall() removes both, in case the user switched modes.

11 */

src/cli-user.jsView file

Lines 43-113javascript

43 console.error('Usage: collab-mcp user create <username> [role]');

44 return 1;

45 }

46 const role = args[1] || 'user';

47 if (role !== 'admin' && role

Source & flagged code

4 flagged · loading source

src/cli-install.jsView file

114patternName = generic_password severity = medium line = 114 matchedText = console....rd);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

src/service-windows.jsView file

12L13: const { execFileSync } = require('child_process'); L14: const fs = require('fs'); ... L30: fs.mkdirSync(wrapperDir(), { recursive: true }); L31: // bin/collab-mcp.js sits next to package.json in the install root; we L32: // resolve via the package root so the wrapper works regardless of cwd. L33: const pkgRoot = path.resolve(__dirname, '..'); L34: const scriptPath = path.join(pkgRoot, 'bin', 'collab-mcp.js'); ... L59: const taskXml = `<?xml version="1.0" encoding="UTF-16"?> L60: <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> L61: <RegistrationInfo><Description>Collab MCP autostart</Description></RegistrationInfo> ... L76: fs.writeFileSync(xmlPath, taskXml, 'utf16le');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service-windows.jsView on unpkg · L12

src/cli-user.jsView file

63patternName = generic_password severity = medium line = 63 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in src/cli-user.js

src/cli-user.jsView on unpkg · L63

93patternName = generic_password severity = medium line = 93 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in src/cli-user.js

src/cli-user.jsView on unpkg · L93

Findings

6 Medium4 Low

MediumSecret Patternsrc/cli-install.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/service-windows.js

MediumSecret Patternsrc/cli-user.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/cli-install.jsView file

Lines 94-134javascript

94 } else {

95 try {

96 const u = await prompt('Admin username [admin]: ');

97 username = (u || 'admin').trim();

98 password = await prompt('Admin password (empty = random): ');

99 } catch (_) {

100 // readline blew up (rare); fall back to random

101 password = crypto.randomBytes(16).toString('base64url');

102 console.log('✓ Interactive prompt failed → generated random admin password');

103 }

104 if (!password) {

105 password = crypto.randomBytes(16).toString('base64url');

106 console.log('✓ Generated random admin password');

107 }

108 }

109

110 try {

111 const hash = await auth.hashPassword(password);

112 db.createUser({ username, password_hash: hash, role: 'admin' });

113 console.log('✓ Created admin user: ' + username);

114 console.log(' password: ' + password);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

115 console.log(' (change with: collab-mcp user passwd ' + username + ')');

116 } catch (e) {

117 console.error('✗ Failed to create admin user:', e.message);

118 db.close();

119 return 1;

120 }

121 }

122

123 // 5. Admin API key (DB-backed, replaces Phase 1 configStore.api_keys.admin)

124 const existingAdminKeys = db.listApiKeys().filter((k) => k.name === 'admin' && !k.revoked);

125 if (existingAdminKeys.length > 0) {

126 console.log('• admin API key already exists (use `collab-mcp keys list` to view)');

127 } else {

128 const id = 'cmcp_' + crypto.randomBytes(16).toString('hex');

129 const secret = crypto.randomBytes(32).toString('base64url');

130 const hash = await auth.hashPassword(secret);

131 try {

132 db.createApiKey({

133 id,

134 name: 'admin',

src/service-windows.jsView file

Lines 1-32javascript

1'use strict';

3/**

4 * service-windows.js - Windows service installer

5 *

6 * Strategy:

7 * 1. Write a .bat wrapper at ~/.collab-mcp/bin/service-start.bat

8 * 2. Try sc.exe create (requires admin). If that fails, fall back to a

9 * Logon-triggered Scheduled Task (no admin required).

10 * 3. uninstall() removes both, in case the user switched modes.

11 */

src/cli-user.jsView file

Lines 43-113javascript

43 console.error('Usage: collab-mcp user create <username> [role]');

44 return 1;

45 }

46 const role = args[1] || 'user';

47 if (role !== 'admin' && role