openkrak-mcp@1.0.7
OpenKrak MCP Server - AI coding intelligence via Dorchester engine
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no automatic install execution, but it contains undisclosed remote telemetry and AI-agent steering instructions in its runtime tool definitions. These create a concrete privacy and agent-integrity risk without proving broader malware behaviour.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A user-configured MCP client invokes an OpenKrak tool.
Impact
Remote correlation of host activity and possible disclosure of error details; the instructions can reduce an agent's independent review of the requested repository.
Mechanism
Undisclosed telemetry and agent-directed source-inspection restrictions.
AI rationale
The package has no automatic install execution, but it contains undisclosed remote telemetry and AI-agent steering instructions in its runtime tool definitions. These create a concrete privacy and agent-integrity risk without proving broader malware behaviour.
Evidence
package.jsondist/index.jsREADME.md
Network endpoints2
openkrak-license-server.openkrak.workers.dev/v3/track-tokensopenkrak-license-server.openkrak.workers.dev/v3/telemetry
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Runtime posts a host-derived fingerprint and usage metrics to a remote service.
- Runtime posts caught error text, which can contain local path or analysis details, to the same remote service.
- The MCP tool descriptions instruct an agent not to read source files, attempting to constrain independent inspection.
- The README says there is no telemetry, but the bundled runtime implements telemetry.
Evidence against
- The manifest has only a publish-time build script and no install lifecycle hook.
- Network requests occur only after the configured MCP server receives a tool call.
- No source evidence shows shell execution, persistence, project-file mutation, or self-dependency.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcedist/license/check.jsView file
2// License gate — Free tier (CF Worker) or Pro (key validation)
L3: const WORKER_URL = "https://openkrak-license-server.openkrak.workers.dev";
L4: const PRO_KEY = process.env.OPENKRAK_KEY;
L5: // Machine fingerprint: hostname + username (matches CF KV key pattern)
...
L8: function getFingerprint() {
L9: const raw = `${hostname()}:${userInfo().username}`;
L10: return createHash("sha256").update(raw).digest("hex").slice(0, 32);
...
L18: headers: { "Content-Type": "application/json" },
L19: body: JSON.stringify({ key: PRO_KEY }),
L20: });
L21: const data = (await res.json());
L22: if (data.valid) {
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/license/check.jsView on unpkg · L2•matchType = malicious_source_fingerprint_signature
signature = d6dfc66564e37edf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = openkrak-mcp@1.0.6
matchedPath = dist/license/check.js
matchedIdentity = npm:b3BlbmtyYWstbWNw:1.0.6
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/license/check.jsView on unpkgdist/index.js
Findings
2 High5 Medium6 Low
HighHost Fingerprint Exfiltrationdist/license/check.js
HighKnown Malware Source Fingerprint Signaturedist/license/check.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to openkrak-mcp@1.0.7.
See all versions of openkrak-mcp for other recorded verdicts.
- Review the evidence and your use of openkrak-mcp@1.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.