registry / openkrak-mcp / 1.0.4

openkrak-mcp@1.0.4

OpenKrak MCP Server â€” AI coding intelligence via Dorchester engine

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On an MCP tool request, the package sends license data or a host-derived fingerprint to its Cloudflare Worker. If analysis fails, it also sends the error text as telemetry, which can disclose local error details.

Static reason

One or more suspicious static signals were detected.

Trigger

A configured MCP client invokes any OpenKrak tool; telemetry is triggered when that tool throws.

Impact

A remote service receives host-linked identifiers, license keys when configured, and potentially sensitive error text.

Mechanism

Remote licensing and undisclosed error telemetry.

Rationale

This is not an install-time payload and no destructive behavior was found, but the running bundle contains undisclosed remote telemetry of host-linked error data and manipulative agent instructions. The behavior warrants a warning rather than a publication block because source-file exfiltration is not established.

Evidence

package.jsondist/index.jsREADME.md

Network endpoints3

openkrak-license-server.openkrak.workers.dev/v3/validateopenkrak-license-server.openkrak.workers.dev/v3/free-queryopenkrak-license-server.openkrak.workers.dev/v3/telemetry

openkrak-mcp@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code