answerrail-mcp@1.2.6
All-in-one 6-Category Structural AI Readiness Audit & Auto-Remediation MCP Server for Claude Desktop, Claude Code & Cursor: scans 20+ Schema.org JSON-LD types, 14+ robots.txt AI bot rules, /llms.txt, /.well-known/ai-catalog.json (ARD 1.0) & 25k-token pric
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe executable sends a stable, host-derived identifier automatically on MCP initialization, with no visible consent gate. The first-party recipient and limited inspected payload do not establish a concrete malicious attack, so this warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An MCP client sends an initialize message.
Impact
The package operator can associate repeated server starts with a persistent pseudonymous machine identifier.
Mechanism
The server hashes machine and user attributes, then includes the resulting identifier and client metadata in a POST to the telemetry endpoint.
AI rationale
The executable sends a stable, host-derived identifier automatically on MCP initialization, with no visible consent gate. The first-party recipient and limited inspected payload do not establish a concrete malicious attack, so this warrants a warning.
Evidence
bin/mcp-server.js
Network endpoints1
answerrail.com/api/telemetry/funnel
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes bin/mcp-server.js as its command entrypoint.
- The server derives a stable, shortened hash from the machine hostname, platform, architecture, and username.
- Its telemetry function posts that identifier and client metadata to https://answerrail.com/api/telemetry/funnel.
- Every MCP initialize message triggers a funnel event without a visible consent check.
- A user-invoked audit also reports its target URL and audit results to the same telemetry endpoint.
Evidence against
- The telemetry recipient is the package's own AnswerRail service; the inspected code does not show credential or file collection.
- Audit URL reporting occurs in the audit tool path, while the automatic initialization event contains client identity metadata.
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedbin/mcp-server.jsView file
19.createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
...
L207: const [auditRes, llmsRes, ardRes, robotsRes] = await Promise.all([
L208: safeFetch(`https://answerrail.com/api/audit?url=${encodeURIComponent(parsed.href)}`).then((r) => (r ? r.json() : {})).catch(() => ({})),
L209: safeFetch(`${origin}/llms.txt`, { redirect: 'follow' }).then(async (r) => ({ status: r?.status || 0,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
bin/mcp-server.jsView on unpkg · L1919Trigger-reachable chain: manifest.bin -> bin/mcp-server.js
L19: .createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
...
L207: const [auditRes, llmsRes, ardRes, robotsRes] = await Promise.all([
L208: safeFetch(`https://answerrail.com/api/audit?url=${encodeURIComponent(parsed.href)}`).then((r) => (r ? r.json() : {})).catch(() => ({})),
L209: safeFetch(`${origin}/llms.txt`, { redirect
Findings
2 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationbin/mcp-server.js
CriticalTrigger Reachable Dangerous Capabilitybin/mcp-server.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to answerrail-mcp@1.2.6.
See all versions of answerrail-mcp for other recorded verdicts.
- Review the evidence and your use of answerrail-mcp@1.2.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.