asrai-mcp-apikey@1.5.8

Asrai crypto analysis MCP server — API key auth for ADVANCED plan users.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and skill installation occurs through an explicit command that copies package-bundled files into detected skill directories. Runtime key use targets the package’s Asrai MCP service; no concrete attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

The user runs the install-skill command or starts the CLI/MCP bridge.

Impact

The inspected behavior supports the package’s stated functionality; no unrelated agent configuration mutation or credential recipient was found.

Mechanism

The installer copies bundled skill files into detected skills directories; the bridge sends the supplied API key to the fixed Asrai MCP endpoint.

AI rationale

Evidence

package.jsonbin/install-skill.jsskill/SKILL.mdbin/asrai-mcp-apikey.js

Network endpoints1

mcp-api.asrai.me

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes install-skill as an explicit command, bundles the skill files, and defines no lifecycle script.
The installer copies bundled skill files only when it finds a supported skills directory; the skill describes Asrai crypto analysis and its install command.
The bridge reads a caller-provided API key and sends it to the fixed Asrai MCP service.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 147 KB of source, external domains: apiasr.asrai.me, asrai.me, github.com, mcp-api.asrai.me

Source & flagged code

7 flagged

bin/install-skill.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node import { existssync, mkdirsync, copyfilesync } from 'fs'; import { join, dirname } from 'path'; import { homedir } from 'os'; import { fileurltopath } from 'url'; const __dirname = dirname(fileurltopath(import.meta.url)); const home = homedir(); const skill_src = join(__dirname, '..', 'skill', 'skill.md'); const endpoints_src = join(__dirname, '..', 'skill', 'references', 'endpoints.md');

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install-skill.jsView on unpkg

48function installTo(destDir, label) { mkdirSync(join(destDir, 'references'), { recursive: true }); copyFileSync(SKILL_SRC, join(destDir, 'SKILL.md')); copyFileSync(ENDPOINTS_S

Low

Ai Review Evidence

The installer copies bundled skill files only when it finds a supported skills directory; the skill describes Asrai crypto analysis and its install command.

bin/install-skill.jsView on unpkg · L48

Findings

1 High2 Medium9 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install-skill.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/install-skill.js

LowAi Review Evidenceskill/SKILL.md

LowAi Review Evidencebin/asrai-mcp-apikey.js

Affected versions and remediation

This report applies to asrai-mcp-apikey@1.5.8.

See all versions of asrai-mcp-apikey for other recorded verdicts.

Review the evidence and your use of asrai-mcp-apikey@1.5.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 14:40:13.929Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / asrai-mcp-apikey / 1.5.8

asrai-mcp-apikey@1.5.8

Asrai crypto analysis MCP server — API key auth for ADVANCED plan users.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

The user runs the install-skill command or starts the CLI/MCP bridge.

Impact

The inspected behavior supports the package’s stated functionality; no unrelated agent configuration mutation or credential recipient was found.

Mechanism

The installer copies bundled skill files into detected skills directories; the bridge sends the supplied API key to the fixed Asrai MCP endpoint.

AI rationale

Evidence

package.jsonbin/install-skill.jsskill/SKILL.mdbin/asrai-mcp-apikey.js

Network endpoints1

mcp-api.asrai.me

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes install-skill as an explicit command, bundles the skill files, and defines no lifecycle script.
The installer copies bundled skill files only when it finds a supported skills directory; the skill describes Asrai crypto analysis and its install command.
The bridge reads a caller-provided API key and sends it to the fixed Asrai MCP service.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 147 KB of source, external domains: apiasr.asrai.me, asrai.me, github.com, mcp-api.asrai.me

Source & flagged code

7 flagged

bin/install-skill.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install-skill.jsView on unpkg

48function installTo(destDir, label) { mkdirSync(join(destDir, 'references'), { recursive: true }); copyFileSync(SKILL_SRC, join(destDir, 'SKILL.md')); copyFileSync(ENDPOINTS_S

Low

Ai Review Evidence

The installer copies bundled skill files only when it finds a supported skills directory; the skill describes Asrai crypto analysis and its install command.

bin/install-skill.jsView on unpkg · L48

Findings

1 High2 Medium9 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install-skill.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/install-skill.js

LowAi Review Evidenceskill/SKILL.md

LowAi Review Evidencebin/asrai-mcp-apikey.js

Affected versions and remediation

This report applies to asrai-mcp-apikey@1.5.8.

See all versions of asrai-mcp-apikey for other recorded verdicts.

Review the evidence and your use of asrai-mcp-apikey@1.5.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 14:40:13.929Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.