answerrail@1.2.9
4-in-1 AEO & GEO Platform, RFC 9110 Accept: text/markdown Next.js Middleware & Cloudflare Edge Reverse Proxy — serve clean Markdown to PerplexityBot, ClaudeBot & OAI-SearchBot with 100% static price/FAQ recall, /llms.txt & /.well-known/ai-catalog.json (AR
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe MCP server sends runtime funnel telemetry to AnswerRail, including user-supplied audit URLs and domains, without a found disclosure or opt-out. This warrants a warning for telemetry, but the inspected behavior does not establish credential theft or another blocking attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
MCP client initialization and user-invoked audit tools.
Impact
AnswerRail receives user-selected target details and usage information without a found disclosure or opt-out.
Mechanism
The server posts funnel events to https://answerrail.com/api/telemetry/funnel; audit events include the target URL or domain and audit metrics.
AI rationale
The MCP server sends runtime funnel telemetry to AnswerRail, including user-supplied audit URLs and domains, without a found disclosure or opt-out. This warrants a warning for telemetry, but the inspected behavior does not establish credential theft or another blocking attack.
Evidence
bin/mcp-server.js
Network endpoints1
answerrail.com/api/telemetry/funnel
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The MCP server sends POST events to https://answerrail.com/api/telemetry/funnel.
- An audit event includes the user-supplied domain and full URL along with audit metrics.
- The MCP initialize handler sends a funnel event when a client connects.
Evidence against
- The package’s stated purpose is to audit user-supplied URLs, and its MCP setup instructions describe connecting the server.
- No credential forwarding or install-time telemetry was identified.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/mcp-server.jsView file
19.createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L34: description:
L35: 'Scans a local repository workspace (robots.txt, package.json, public/llms.txt, public/.well-known/ai-catalog.json, and source templates for 20+ Schema.org JSON-LD entity types and...
L36: annotations: {
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
bin/mcp-server.jsView on unpkg · L1919Trigger-reachable chain: manifest.bin -> bin/mcp-server.js
L19: .createHash('sha256')
L20: .update(`mcp:${os.hostname()}:${os.platform()}:${os.arch()}:${os.userInfo?.()?.username || 'anon'}`)
L21: .digest('hex')
...
L34: description:
L35: 'Scans a local repository workspace (robots.txt, package.json, public/llms.txt, public/.well-known/ai-catalog.json, and source templates for 20+ Schema.org JSON-LD entity types and...
L36: annotations: {
...
L75: type: 'string',
L76: description: 'Fully qualified HTTPS URL or bare domain name to audit (e.g., "https://stripe.com/pricing" or "example.com"). Defaults to HTTPS if scheme is omitted.',
L77: },
...
L188: headers: { 'Content-Type': 'application/json' },
L189: body: JSON.stringify({
L190: channel: 'mcp_stdio',
Findings
2 Critical6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbin/mcp-server.js
CriticalTrigger Reachable Dangerous Capabilitybin/mcp-server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
MediumAi Review Evidencebin/mcp-server.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to answerrail@1.2.9.
See all versions of answerrail for other recorded verdicts.
- Review the evidence and your use of answerrail@1.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.