answerrail-mcp@1.0.1
Model Context Protocol (MCP) server for AnswerRail: audit 25k-token RAG truncation, /llms.txt, Google Lighthouse 13.5 ard-schema (ai-catalog.json), and compile Byte-0 Markdown.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe executable implements caller-invoked website auditing for the package’s named AnswerRail service. Its telemetry shares the supplied URL with that service, but the inspected source does not establish credential collection or other attack behavior.
Decision evidence
public snapshot- package.json points the executable entrypoint to the MCP server.
- The audit accepts a URL from the caller and sends it to AnswerRail’s audit API as part of the requested workflow.
- The funnel telemetry runs when a caller invokes a tool and sends the supplied URL and domain to AnswerRail.
- Tool-call telemetry discloses the caller-supplied URL, including any path or query string, to AnswerRail without a separate opt-in.
Source & flagged code
5 flaggedSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
bin/mcp-server.jsView on unpkg · L25A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bin/mcp-server.jsView on unpkg · L25Findings
Affected versions and remediation
This report applies to answerrail-mcp@1.0.1.
See all versions of answerrail-mcp for other recorded verdicts.
- Review the evidence and your use of answerrail-mcp@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.