asrai-mcp-apikey@1.7.4
Asrai crypto analysis MCP server — API key auth for ADVANCED plan users.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package's documented API-key flows and explicit skill installer appear consistent with its purpose. Server mode also records failed tool-call arguments in its database without a user-facing opt-out, which presents a runtime telemetry risk.
Static reason
No blocking static signals were detected.
Trigger
A tool call handled by the server while ASRAI_INTERNAL_KEY is set; argument details are recorded when the call returns an error.
Impact
User-provided tool arguments may be retained for operational logging. The code truncates arguments and masks fields with secret-like names, but does not disclose a user-facing opt-out.
Mechanism
The handler passes the tool arguments to failInfo, then logToolCall inserts the resulting fields into mcp_tool_calls.
AI rationale
The package's documented API-key flows and explicit skill installer appear consistent with its purpose. Server mode also records failed tool-call arguments in its database without a user-facing opt-out, which presents a runtime telemetry risk.
Evidence
src/server.jssrc/tool-log.jsmcp_tool_calls database table
Network endpoints2
mcp-api.asrai.meapiasr.asrai.me
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- In server mode, each tool call is logged to the mcp_tool_calls database table, including failed-call details and arguments.
- Logging runs after a tool call and only when ASRAI_INTERNAL_KEY is set; failed-call arguments are truncated and secret-looking fields are masked.
- The install-skill command copies the bundled skill files only when explicitly run, and API keys are sent to the package's Asrai service.
Evidence against
- The package declares no preinstall, install, or postinstall hook; its only lifecycle script is prepublishOnly.
- The stdio bridge sends its API key to the documented Asrai MCP endpoint as part of the stated API-key service.
- Exchange credentials are sent to the configured Asrai API endpoint for the positions tool.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/install-skill.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
#!/usr/bin/env node
import { existssync, mkdirsync, copyfilesync } from 'fs';
import { join, dirname } from 'path';
import { homedir } from 'os';
import { fileurltopath } from 'url';
const __dirname = dirname(fileurltopath(import.meta.url));
const home = homedir();
const skill_src = join(__dirname, '..', 'skill', 'skill.md');
const endpoints_src = join(__dirname, '..', 'skill', 'references', 'endpoints.md');
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/install-skill.jsView on unpkgsrc/server.jsView file
63// ── Usage log ─────────────────────────────────────────────────────────────────
// Server mode only (the hosted mcp-api.asrai.me, which has the database): one row per tool call in
// mcp_tool_calls, so we can see which tools agents really use. Fire-and-forget — it never delays or breaks a call.
// A f
Findings
1 High6 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install-skill.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencesrc/server.js
MediumAi Review Evidencesrc/server.js
MediumAi Review Evidencesrc/server.js
MediumAi Review Evidencesrc/tool-log.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to asrai-mcp-apikey@1.7.4.
See all versions of asrai-mcp-apikey for other recorded verdicts.
- Review the evidence and your use of asrai-mcp-apikey@1.7.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.