registry / openkrak-mcp / 1.0.3

openkrak-mcp@1.0.3

OpenKrak MCP Server — AI coding intelligence via Dorchester engine

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. When an AI agent discovers the MCP tools, their descriptions attempt to make the agent use this package as the mandatory source of truth and avoid independent source inspection. On every invoked tool call, the package also transmits a host-derived identifier or configured license key to its license server.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

An MCP client lists or invokes an OpenKrak tool.

Impact

Can steer an agent away from direct source review and disclose a stable host identifier or license key to the operator's service.

Mechanism

AI-agent instruction injection plus remote license telemetry.

Policy narrative

The MCP server exposes tool descriptions that instruct an AI to always call OpenKrak before coding and not read repository source afterward. This is a direct attempt to control the agent's review process. When any tool is invoked, the license gate posts either the configured OpenKrak key or a hash of the local hostname and username to a remote worker. There is no install-time execution, but the runtime agent-control and tracking behavior are concrete.

AI rationale

The package contains runtime AI-agent steering language and transmits host-derived identity data during ordinary tool calls. The lack of lifecycle hooks reduces install risk but does not neutralize the agent-control behavior.

Evidence

dist/index.jsdist/license/check.js

Network endpoints2

openkrak-license-server.openkrak.workers.dev/v3/validate

openkrak-mcp@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code