answerrail@1.2.6
4-in-1 AEO & GEO Platform, RFC 9110 Accept: text/markdown Next.js Middleware & Cloudflare Edge Reverse Proxy — serve clean Markdown to PerplexityBot, ClaudeBot & OAI-SearchBot with 100% static price/FAQ recall, /llms.txt & /.well-known/ai-catalog.json (AR
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource confirms automatic runtime telemetry with host-derived and client metadata and no visible opt-in, so a warning is appropriate. The recipient is package-aligned and the inspected event does not establish credential theft or other malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An MCP client initializes the server.
Impact
The publisher receives a pseudonymous host identifier and client metadata without a source-visible telemetry opt-in.
Mechanism
The server hashes host and user details, then includes that identifier and MCP client name and version in a telemetry POST.
AI rationale
Source confirms automatic runtime telemetry with host-derived and client metadata and no visible opt-in, so a warning is appropriate. The recipient is package-aligned and the inspected event does not establish credential theft or other malicious behavior.
Evidence
bin/mcp-server.js
Network endpoints1
answerrail.com/api/telemetry/funnel
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The MCP server derives a short hash from the machine name, platform, architecture, and username.
- On MCP initialization, the server posts an event containing that hash and the connected client name and version to answerrail.com.
Evidence against
- The event goes to the package-branded answerrail.com domain and is sent when an MCP client initializes the server.
- The inspected event contains host and client metadata; no credentials or user content are included in this event.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/mcp-server.jsView file
19.createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
...
L207: const [auditRes, llmsRes, ardRes, robotsRes] = await Promise.all([
L208: safeFetch(`https://answerrail.com/api/audit?url=${encodeURIComponent(parsed.href)}`).then((r) => (r ? r.json() : {})).catch(() => ({})),
L209: safeFetch(`${origin}/llms.txt`, { redirect: 'follow' }).then(async (r) => ({ status: r?.status || 0,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
bin/mcp-server.jsView on unpkg · L1919Trigger-reachable chain: manifest.bin -> bin/mcp-server.js
L19: .createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
...
L207: const [auditRes, llmsRes, ardRes, robotsRes] = await Promise.all([
L208: safeFetch(`https://answerrail.com/api/audit?url=${encodeURIComponent(parsed.href)}`).then((r) => (r ? r.json() : {})).catch(() => ({})),
L209: safeFetch(`${origin}/llms.txt`, { redirect
Findings
2 Critical1 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbin/mcp-server.js
CriticalTrigger Reachable Dangerous Capabilitybin/mcp-server.js
HighSemantic Analysis Limitedbin/test-ai-ready.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to answerrail@1.2.6.
See all versions of answerrail for other recorded verdicts.
- Review the evidence and your use of answerrail@1.2.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.