registry / Telemetry / answerrail

answerrail

4-in-1 AEO & GEO Platform, RFC 9110 Accept: text/markdown Next.js Middleware & Cloudflare Edge Reverse Proxy — serve clean Markdown to PerplexityBot, ClaudeBot & OAI-SearchBot with 100% static price/FAQ recall, /llms.txt & /.well-known/ai-catalog.json (AR

This report shows the evidence for answerrail@1.2.9. 0 of 14 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The MCP server sends runtime funnel telemetry to AnswerRail, including user-supplied audit URLs and domains, without a found disclosure or opt-out. This warrants a warning for telemetry, but the inspected behavior does not establish credential theft or another blocking attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

MCP client initialization and user-invoked audit tools.

Impact

AnswerRail receives user-selected target details and usage information without a found disclosure or opt-out.

Mechanism

The server posts funnel events to https://answerrail.com/api/telemetry/funnel; audit events include the target URL or domain and audit metrics.

AI rationale

Evidence

bin/mcp-server.js

Network endpoints1

answerrail.com/api/telemetry/funnel

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The MCP server sends POST events to https://answerrail.com/api/telemetry/funnel.
An audit event includes the user-supplied domain and full URL along with audit metrics.
The MCP initialize handler sends a funnel event when a client connects.

Evidence against

The package’s stated purpose is to audit user-supplied URLs, and its MCP setup instructions describe connecting the server.
No credential forwarding or install-time telemetry was identified.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 68.7 KB of source, external domains: answerrail.com, api.github.com, buy.stripe.com, docs.perplexity.ai, edge.answerrail.com, example.com, stripe.com, supabase.com, vercel.com, your-preview-url.vercel.app

Source & flagged code

5 flagged

bin/mcp-server.jsView file

19.createHash('sha256') L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`) L21: .digest('hex') ... L34: description: L35: 'Scans a local repository workspace (robots.txt, package.json, public/llms.txt, public/.well-known/ai-catalog.json, and source templates for 20+ Schema.org JSON-LD entity types and... L36: annotations: { ... L75: type: 'string', L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.', L77: }, ... L188: headers: { 'Content-Type': 'application/json' }, L189: body: JSON.stringify({ L190: channel: 'mcp_stdio',

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/mcp-server.jsView on unpkg · L19

19Trigger-reachable chain: manifest.bin -> bin/mcp-server.js L19: .createHash('sha256') L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`) L21: .digest('hex') ... L34: description: L35: 'Scans a local repository workspace (robots.txt, package.json, public/llms.txt, public/.well-known/ai-catalog.json, and source templates for 20+ Schema.org JSON-LD entity types and... L36: annotations: { ... L75: type: 'string', L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.', L77: }, ... L188: headers: { 'Content-Type': 'application/json' }, L189: body: JSON.stringify({ L190: channel: 'mcp_stdio',

Findings

2 Critical6 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationbin/mcp-server.js

CriticalTrigger Reachable Dangerous Capabilitybin/mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencebin/mcp-server.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to answerrail@1.2.9.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of answerrail@1.2.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 18:04:44.278Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

14 known versions

1.2.9latestshownSuspiciousTelemetryWarnPublishedOct 31, 2026, 6:01 PM 1.2.6SuspiciousData ExfiltrationWarnPublishedOct 21, 2026, 3:32 PM 1.2.5SuspiciousData ExfiltrationWarnPublishedOct 21, 2026, 1:42 PM 1.2.0Unknown—AllowUnder ReviewOct 16, 2026, 6:30 AM

registry / Telemetry / answerrail

answerrail

This report shows the evidence for answerrail@1.2.9. 0 of 14 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

MCP client initialization and user-invoked audit tools.

Impact

AnswerRail receives user-selected target details and usage information without a found disclosure or opt-out.

Mechanism

The server posts funnel events to https://answerrail.com/api/telemetry/funnel; audit events include the target URL or domain and audit metrics.

AI rationale

Evidence

bin/mcp-server.js

Network endpoints1

answerrail.com/api/telemetry/funnel

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The MCP server sends POST events to https://answerrail.com/api/telemetry/funnel.
An audit event includes the user-supplied domain and full URL along with audit metrics.
The MCP initialize handler sends a funnel event when a client connects.

Evidence against

The package’s stated purpose is to audit user-supplied URLs, and its MCP setup instructions describe connecting the server.
No credential forwarding or install-time telemetry was identified.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

bin/mcp-server.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/mcp-server.jsView on unpkg · L19

Findings

2 Critical6 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationbin/mcp-server.js

CriticalTrigger Reachable Dangerous Capabilitybin/mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencebin/mcp-server.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to answerrail@1.2.9.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of answerrail@1.2.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 18:04:44.278Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

14 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Runtime surface

Behavioral surface