answerrail-mcp@1.2.9
6-Category Structural AI Readiness, Chrome Lighthouse 13.5 ard-schema (ai-catalog.json / ard.json), Schema.org, robots.txt, /llms.txt & 25k-Token Truncation Audit MCP Server for Claude Desktop, Claude Code & Cursor
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe server sends undisclosed telemetry to its vendor on every MCP initialization, including a host-derived identifier and client details. The package’s user-requested website audit traffic is consistent with its stated purpose, but the automatic identifying telemetry warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Automatically when an MCP client initializes; additional events follow tool calls.
Impact
The vendor can associate MCP usage with a stable host-derived identifier and learn which client connected. This is undisclosed runtime telemetry, so it is suspicious.
Mechanism
POSTs event JSON, including ACTOR_ID and connected client metadata, to https://answerrail.com/api/telemetry/funnel. The identifier is derived from hostname, platform, architecture, and OS username.
AI rationale
The server sends undisclosed telemetry to its vendor on every MCP initialization, including a host-derived identifier and client details. The package’s user-requested website audit traffic is consistent with its stated purpose, but the automatic identifying telemetry warrants a warning.
Evidence
bin/mcp-server.js
Network endpoints2
answerrail.com/api/telemetry/funnelanswerrail.com/api/audit
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The server hashes a value containing the machine hostname, platform, architecture, and OS username into ACTOR_ID.
- It posts actorId, client metadata, and event payloads to https://answerrail.com/api/telemetry/funnel.
- Every MCP initialize request automatically reports an mcp_init event with the connected client name.
- The audit feature also sends a user-submitted URL to AnswerRail’s audit API, consistent with the package’s stated website-auditing purpose.
Evidence against
- The package has no install or postinstall lifecycle scripts.
- Its stated purpose includes auditing websites, so sending a requested target URL to its own audit service is consistent with that function.
- No credentials, file contents, or other environment-variable values were observed in the telemetry flow.
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/mcp-server.jsView file
19.createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L34: description:
L35: 'Scans a local repository workspace (robots.txt, package.json, public/llms.txt, public/.well-known/ai-catalog.json, and source templates for 20+ Schema.org JSON-LD entity types and...
L36: annotations: {
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
bin/mcp-server.jsView on unpkg · L1919Trigger-reachable chain: scripts.start -> bin/mcp-server.js
L19: .createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L34: description:
L35: 'Scans a local repository workspace (robots.txt, package.json, public/llms.txt, public/.well-known/ai-catalog.json, and source templates for 20+ Schema.org JSON-LD entity types and...
L36: annotations: {
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
Findings
2 Critical6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbin/mcp-server.js
CriticalTrigger Reachable Dangerous Capabilitybin/mcp-server.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to answerrail-mcp@1.2.9.
See all versions of answerrail-mcp for other recorded verdicts.
- Review the evidence and your use of answerrail-mcp@1.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.