answerrail@1.2.5
Content negotiation for Next.js & Cloudflare Edge — serve clean Markdown to AI crawlers (PerplexityBot, ClaudeBot, OAI-SearchBot) via Accept: text/markdown, HTML to browsers, and generate /llms.txt + /.well-known/ai-catalog.json (ARD 1.0)
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe scanner’s credential exfiltration claim is not supported by the inspected sender: it transmits telemetry metadata to the package’s own service. Automatic transmission of a stable machine and user identifier still presents a privacy risk, so a warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The MCP client initializes a connection to the server.
Impact
The vendor can correlate MCP installations and client versions with machine-derived identifiers.
Mechanism
The server hashes machine and user attributes into a stable identifier and posts it with client and event metadata to the vendor’s funnel endpoint.
AI rationale
The scanner’s credential exfiltration claim is not supported by the inspected sender: it transmits telemetry metadata to the package’s own service. Automatic transmission of a stable machine and user identifier still presents a privacy risk, so a warning is appropriate.
Evidence
bin/mcp-server.js
Network endpoints1
answerrail.com/api/telemetry/funnel
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On each MCP initialize handshake, the server automatically sends a funnel event without an affirmative consent check.
- The event includes a stable identifier derived from the machine hostname, platform, architecture, and username, along with MCP client identity and version.
- The identifier and event are sent by POST to the package vendor’s telemetry endpoint.
Evidence against
- The telemetry recipient is the package’s own service, consistent with product analytics.
- The inspected telemetry payload contains usage and client metadata, not credentials or audit contents.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/mcp-server.jsView file
19.createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
...
L207: const [auditRes, llmsRes, ardRes, robotsRes] = await Promise.all([
L208: safeFetch(`https://answerrail.com/api/audit?url=${encodeURIComponent(parsed.href)}`).then((r) => (r ? r.json() : {})).catch(() => ({})),
L209: safeFetch(`${origin}/llms.txt`, { redirect: 'follow' }).then(async (r) => ({ status: r?.status || 0,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
bin/mcp-server.jsView on unpkg · L1919Trigger-reachable chain: manifest.bin -> bin/mcp-server.js
L19: .createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
...
L207: const [auditRes, llmsRes, ardRes, robotsRes] = await Promise.all([
L208: safeFetch(`https://answerrail.com/api/audit?url=${encodeURIComponent(parsed.href)}`).then((r) => (r ? r.json() : {})).catch(() => ({})),
L209: safeFetch(`${origin}/llms.txt`, { redirect
Findings
2 Critical1 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbin/mcp-server.js
CriticalTrigger Reachable Dangerous Capabilitybin/mcp-server.js
HighSemantic Analysis Limitedbin/test-ai-ready.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to answerrail@1.2.5.
See all versions of answerrail for other recorded verdicts.
- Review the evidence and your use of answerrail@1.2.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.