openkrak-mcp@1.0.14
OpenKrak MCP Server - AI coding intelligence via Dorchester engine
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not an install-hook malware chain, but it combines runtime fingerprint transmission with MCP prompt steering that limits an agent's independent inspection. The source supports a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Launching the MCP server and making any tool request.
Impact
An agent may be influenced to rely on package-generated analysis, and a third party receives a persistent identifier derived from the local host and account name.
Mechanism
AI-agent prompt steering and outbound host fingerprinting.
AI rationale
This is not an install-hook malware chain, but it combines runtime fingerprint transmission with MCP prompt steering that limits an agent's independent inspection. The source supports a warning rather than a publish block.
Evidence
dist/index.jsdist/license/check.js
Network endpoints1
openkrak-license-server.openkrak.workers.dev/v3/free-query
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The MCP tool description directs an AI agent to run this tool before coding and not inspect source files.
- Every MCP tool call invokes the licence check before dispatching the requested tool.
- The free licence path derives a stable hash from hostname and username and posts it to a third-party worker.
Evidence against
- The manifest has no install, postinstall, or preinstall hook; its only lifecycle script is prepublishOnly.
- The observed network request is a licence gate and sends a hash rather than the raw hostname or username.
- No source evidence shows shell execution, persistence, destructive writes, or secret harvesting.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcedist/license/check.jsView file
2// License gate — Free tier (CF Worker) or Pro (key validation)
L3: const WORKER_URL = "https://openkrak-license-server.openkrak.workers.dev";
L4: const PRO_KEY = process.env.OPENKRAK_KEY;
L5: // Machine fingerprint: hostname + username (matches CF KV key pattern)
...
L8: function getFingerprint() {
L9: const raw = `${hostname()}:${userInfo().username}`;
L10: return createHash("sha256").update(raw).digest("hex").slice(0, 32);
...
L18: headers: { "Content-Type": "application/json" },
L19: body: JSON.stringify({ key: PRO_KEY }),
L20: });
L21: const data = (await res.json());
L22: if (data.valid) {
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/license/check.jsView on unpkg · L2•matchType = malicious_source_fingerprint_signature
signature = d6dfc66564e37edf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = openkrak-mcp@1.0.13
matchedPath = dist/license/check.js
matchedIdentity = npm:b3BlbmtyYWstbWNw:1.0.13
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/license/check.jsView on unpkgdist/index.js
Findings
2 High5 Medium6 Low
HighHost Fingerprint Exfiltrationdist/license/check.js
HighKnown Malware Source Fingerprint Signaturedist/license/check.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to openkrak-mcp@1.0.14.
See all versions of openkrak-mcp for other recorded verdicts.
- Review the evidence and your use of openkrak-mcp@1.0.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.