registry / arko-mcp / 0.2.0

arko-mcp@0.2.0

ARKO Model Context Protocol server — brings the ARKO security control engine into Claude Code, Cursor, and any MCP-compatible AI coding agent.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a networked ARKO MCP client with explicit login, scan, HTTP-server, and AutoFix PR workflows.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs arko-mcp, arko-mcp login, arko-mcp serve-http, or invokes MCP tools.

Impact

User-provided code/manifests and bearer tokens are sent to configured ARKO/Cognito endpoints as part of documented functionality.

Mechanism

Authenticated MCP client proxy to ARKO/Cognito services

Rationale

Static source inspection shows a package-aligned MCP security scanning client with documented OAuth and ARKO API communication, not unconsented lifecycle execution, harvesting, or persistence. The scanner's dangerous-delta/network/env findings are explained by the explicit HTTP transport and authentication features.

Evidence

package.jsondist/index.jsdist/http.jsdist/config.jsdist/client.jsdist/tools.jsdist/auth/credentials.jsdist/auth/login.jsdist/auth/cognito.jsdist/auth/tokenProvider.jsdist/auth/loopback.js~/.arko/credentials.json

Network endpoints5

arko.devsecai.io

arko-mcp@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code