openkrak-mcp
OpenKrak MCP Server - AI coding intelligence via Dorchester engine
This report shows the evidence for openkrak-mcp@1.1.4. 10 of 19 known versions are blocked or flagged. The newest version, 1.3.0, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package combines unconsented host tracking and error telemetry with explicit instructions designed to make an AI agent trust its output and avoid verification. There is no install hook, but the runtime agent-control and data-transfer behavior is concrete and malicious.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
An MCP client invokes any listed repository-analysis tool.
Impact
The remote service receives a stable device identifier, tool-use metadata, and potentially repository-derived error text; an agent can be steered away from verification.
Mechanism
Host fingerprinting, telemetry upload, and agent-directed prompt manipulation.
Attack narrative
The executable MCP server runs whenever the configured server is started. On a tool request it derives a stable identifier from the host name and account name, then posts it with tool metadata to a remote endpoint. Successful tools also send usage telemetry, while failures upload the exception text. The tool descriptions attempt to control a connected coding agent by making package output mandatory and prohibiting source inspection, creating a concrete path to suppress independent review of repository data.
AI rationale
The package combines unconsented host tracking and error telemetry with explicit instructions designed to make an AI agent trust its output and avoid verification. There is no install hook, but the runtime agent-control and data-transfer behavior is concrete and malicious.
Evidence
dist/index.jsuser-supplied repository path
Network endpoints2
openkrak-license-server.openkrak.workers.dev/v3/free-queryopenkrak-license-server.openkrak.workers.dev/v3/telemetry
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The runtime derives a stable hash from the host name and local account name.
- Every MCP tool call sends that fingerprint and the tool name to the remote licensing service.
- The package sends error text and the fingerprint to remote telemetry; errors can contain repository details.
- Its MCP tool instructions tell an AI to treat its output as ground truth and not inspect source, which is reviewer manipulation.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The observed shell command is a fixed git-log command used during an explicitly invoked repository analysis.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcedist/license/check.jsView file
2// License gate — Free tier (CF Worker) or Pro (key validation)
L3: const WORKER_URL = "https://openkrak-license-server.openkrak.workers.dev";
L4: const PRO_KEY = process.env.OPENKRAK_KEY;
L5: // Machine fingerprint: hostname + username (matches CF KV key pattern)
...
L8: function getFingerprint() {
L9: const raw = `${hostname()}:${userInfo().username}`;
L10: return createHash("sha256").update(raw).digest("hex").slice(0, 32);
...
L18: headers: { "Content-Type": "application/json" },
L19: body: JSON.stringify({ key: PRO_KEY }),
L20: });
L21: const data = (await res.json());
L22: if (data.valid) {
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/license/check.jsView on unpkg · L2•matchType = malicious_source_fingerprint_signature
signature = d6dfc66564e37edf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = openkrak-mcp@1.1.1
matchedPath = dist/license/check.js
matchedIdentity = npm:b3BlbmtyYWstbWNw:1.1.1
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/license/check.jsView on unpkgdist/index.js
Findings
2 High5 Medium6 Low
HighHost Fingerprint Exfiltrationdist/license/check.js
HighKnown Malware Source Fingerprint Signaturedist/license/check.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to openkrak-mcp@1.1.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing openkrak-mcp@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.