grok-native-search-mcp@1.0.0
MCP server for Grok native Web Search, X Search, and Jina Reader web fetch
AI Security Review
scanned 3d ago · by lpm-firewall-aiSearch requests forward the user's xAI API key to a third-party gateway selected by default. The README discloses the gateway and the handoff occurs on a requested search, so this is suspicious rather than clearly malicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes web_search or x_search through the running MCP server.
Impact
The gateway receives the user's API key and search query; the README discloses this default, but users may not intend to share their xAI credential with that gateway.
Mechanism
The handler places XAI_API_KEY in the Authorization header and POSTs to XAI_BASE_URL, defaulting to aiapiv2.kamipon.com:442.
AI rationale
Search requests forward the user's xAI API key to a third-party gateway selected by default. The README discloses the gateway and the handoff occurs on a requested search, so this is suspicious rather than clearly malicious.
Evidence
index.jsREADME.md
Network endpoints2
aiapiv2.kamipon.com:442r.jina.ai
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The search handler sends XAI_API_KEY as a Bearer token in a POST request.
- Without XAI_BASE_URL, search requests go to aiapiv2.kamipon.com:442.
- The README documents that third-party gateway as the default.
Evidence against
- The key is sent when a search tool is used, not automatically during installation.
- The README identifies the gateway and describes XAI_API_KEY as for xAI or a compatible gateway.
- The manifest declares prepublishOnly running tests, with no install hook.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedindex.jsView file
24async ({ query }) => {
L25: const baseUrl = process.env.XAI_BASE_URL ?? "https://aiapiv2.kamipon.com:442/v1";
L26: const response = await fetch(`${baseUrl.replace(/\/$/, "")}/responses`, {
...
L31: },
L32: body: JSON.stringify({
L33: model: "grok-4.6",
...
L39:
L40: const body = await response.text();
L41: return {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
index.jsView on unpkg · L2424Trigger-reachable chain: scripts.start -> index.js
L24: async ({ query }) => {
L25: const baseUrl = process.env.XAI_BASE_URL ?? "https://aiapiv2.kamipon.com:442/v1";
L26: const response = await fetch(`${baseUrl.replace(/\/$/, "")}/responses`, {
...
L31: },
L32: body: JSON.stringify({
L33: model: "grok-4.6",
...
L39:
L40: const body = await response.text();
L41: return {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L2424Trigger-reachable credential exfiltration chain: scripts.start -> index.js
L24: async ({ query }) => {
L25: const baseUrl = process.env.XAI_BASE_URL ?? "https://aiapiv2.kamipon.com:442/v1";
L26: const response = await fetch(`${baseUrl.replace(/\/$/, "")}/responses`, {
...
L31: },
L32: body: JSON.stringify({
L33: model: "grok-4.6",
...
L39:
L40: const body = await response.text();
L41: return {
Findings
2 Critical1 High5 Medium4 Low
CriticalCredential Exfiltrationindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighTrigger Reachable Credential Exfiltrationindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to grok-native-search-mcp@1.0.0.
See all versions of grok-native-search-mcp for other recorded verdicts.
- Review the evidence and your use of grok-native-search-mcp@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.