registry / onthecheap-mcp / 0.3.0

onthecheap-mcp@0.3.0

On the Cheap MCP server for Claude — developed and maintained by AI (Claude Code)

AI Security Review

scanned 14h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit Claude plugin installation can register and launch this package's MCP server. On user-invoked tool calls, it reads public On the Cheap WordPress pages over HTTPS; no data-exfiltration or destructive behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

User installs/enables the Claude plugin, then invokes an MCP tool.

Impact

Adds a local MCP capability and makes outbound requests to the configured public content sites.

Mechanism

First-party MCP extension with read-only public-web fetches.

Rationale

Source inspection found no lifecycle execution, credential harvesting, writes, child-process use, or remote payload loading. It is a package-owned agent extension, so it warrants a policy warning rather than a malicious block.

Evidence

package.json.claude-plugin/plugin.json.mcp.jsondist/index.jsdist/client.jsdist/tools/posts.js

Network endpoints12

www.charlotteonthecheap.comwww.milehighonthecheap.comatlantaonthecheap.comchicagoonthecheap.comcolumbusonthecheap.com

onthecheap-mcp@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code