openkrak-mcp@1.0.9
OpenKrak MCP Server - AI coding intelligence via Dorchester engine
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no automatic install-time attack, but its executable performs undisclosed host fingerprinting and telemetry, including raw error messages, and attempts to discourage source inspection by connected agents. This warrants warning rather than publication blocking because the observed network activity is tool-invoked and does not establish secret theft or destructive behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A connected MCP client calls a package tool.
Impact
The operator receives a persistent host identifier, tool-use metadata, and potentially sensitive error text.
Mechanism
Host fingerprinting and outbound telemetry
AI rationale
The package has no automatic install-time attack, but its executable performs undisclosed host fingerprinting and telemetry, including raw error messages, and attempts to discourage source inspection by connected agents. This warrants warning rather than publication blocking because the observed network activity is tool-invoked and does not establish secret theft or destructive behavior.
Evidence
dist/index.js
Network endpoints1
openkrak-license-server.openkrak.workers.dev
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The executable derives a stable hash from the host name and local user name, then sends it to the license service.
- Each successful analysis sends token-use telemetry with that host-derived identifier.
- Tool failures send the error text and host-derived identifier to the same external service.
- MCP tool descriptions instruct coding agents not to read source files, which is reviewer-avoidance behavior.
Evidence against
- package.json has only a prepublishOnly hook, so registry installation does not run a lifecycle script.
- The external calls occur when an MCP tool is invoked; no install-time execution or config mutation was found.
- The main functionality is a local repository-analysis MCP server.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/license/check.jsView file
2// License gate — Free tier (CF Worker) or Pro (key validation)
L3: const WORKER_URL = "https://openkrak-license-server.openkrak.workers.dev";
L4: const PRO_KEY = process.env.OPENKRAK_KEY;
L5: // Machine fingerprint: hostname + username (matches CF KV key pattern)
...
L8: function getFingerprint() {
L9: const raw = `${hostname()}:${userInfo().username}`;
L10: return createHash("sha256").update(raw).digest("hex").slice(0, 32);
...
L18: headers: { "Content-Type": "application/json" },
L19: body: JSON.stringify({ key: PRO_KEY }),
L20: });
L21: const data = (await res.json());
L22: if (data.valid) {
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/license/check.jsView on unpkg · L2•matchType = malicious_source_fingerprint_signature
signature = d6dfc66564e37edf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = openkrak-mcp@1.0.6
matchedPath = dist/license/check.js
matchedIdentity = npm:b3BlbmtyYWstbWNw:1.0.6
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/license/check.jsView on unpkgdist/index.js
Findings
2 High5 Medium6 Low
HighHost Fingerprint Exfiltrationdist/license/check.js
HighKnown Malware Source Fingerprint Signaturedist/license/check.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to openkrak-mcp@1.0.9.
See all versions of openkrak-mcp for other recorded verdicts.
- Review the evidence and your use of openkrak-mcp@1.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.