registry / AI-agent control-surface risk / openkrak-mcp / 1.1.2

openkrak-mcp@1.1.2

OpenKrak MCP Server - AI coding intelligence via Dorchester engine

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

There is no automatic install-time execution or confirmed code exfiltration, so a publish block is not warranted. The coercive AI-facing instructions and host fingerprint transmission create a real, unresolved agent-security and privacy risk.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

An MCP client calls analyze_repo, get_mahadata, get_hotspots, or blast_radius.

Impact

An AI coding client may rely on package-generated summaries and skip source inspection, reducing independent security review.

Mechanism

Repository analysis combined with AI-directed source-verification suppression.

AI rationale

Evidence

dist/index.jsdist/license/check.js

Network endpoints1

openkrak-license-server.openkrak.workers.dev

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 95.0% confidence with medium false-positive risk.

Evidence for policy risk

Its MCP tool description directs an AI to treat its output as ground truth and not independently read source files.
On each tool call, it sends a hash derived from the hostname and local username to its license server.
The runtime executes a Git command in the user-supplied repository and analyses that repository.

Evidence against

package.json has no install, postinstall, or preinstall hook.
The observed network calls are tied to licensing, usage accounting, and error telemetry; no source-content upload is present.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 266 KB of source, external domains: github.com, openkrak-license-server.openkrak.workers.dev

Oversized source lightweight scan

Source & flagged code

4 flagged

dist/license/check.jsView file

Lines 1-22javascript

1// openkrak-mcp/src/license/check.ts

2// License gate — Free tier (CF Worker) or Pro (key validation)

3const WORKER_URL = "https://openkrak-license-server.openkrak.workers.dev";

4const PRO_KEY = process.env.OPENKRAK_KEY;

5// Machine fingerprint: hostname + username (matches CF KV key pattern)

6import { createHash } from "node:crypto";

7import { hostname, userInfo } from "node:os";

8function getFingerprint() {

9 const raw = `${hostname()}:${userInfo().username}`;

10 return createHash("sha256").update(raw).digest("hex").slice(0, 32);

11}

12export async function checkLicense() {

13 // Pro key path

14 if (PRO_KEY) {

15 try {

16 const res = await fetch(`${WORKER_URL}/v3/validate`, {

17 method: "POST",

18 headers: { "Content-Type": "application/json" },

19 body: JSON.stringify({ key: PRO_KEY }),

20 });

21 const data = (await res.json());

22 if (data.valid) {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/license/check.jsView on unpkg · L2

•matchType = malicious_source_fingerprint_signature signature = d6dfc66564e37edf signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = openkrak-mcp@1.0.17 matchedPath = dist/license/check.js matchedIdentity = npm:b3BlbmtyYWstbWNw:1.0.17 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/license/check.jsView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 11224406 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 11224406 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/license/check.jsView file

2// License gate — Free tier (CF Worker) or Pro (key validation) L3: const WORKER_URL = "https://openkrak-license-server.openkrak.workers.dev"; L4: const PRO_KEY = process.env.OPENKRAK_KEY; L5: // Machine fingerprint: hostname + username (matches CF KV key pattern) ... L8: function getFingerprint() { L9: const raw = `${hostname()}:${userInfo().username}`; L10: return createHash("sha256").update(raw).digest("hex").slice(0, 32); ... L18: headers: { "Content-Type": "application/json" }, L19: body: JSON.stringify({ key: PRO_KEY }), L20: }); L21: const data = (await res.json()); L22: if (data.valid) {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/license/check.jsView on unpkg · L2

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/license/check.jsView on unpkg

dist/index.js

Findings

2 High5 Medium6 Low

HighHost Fingerprint Exfiltrationdist/license/check.js

HighKnown Malware Source Fingerprint Signaturedist/license/check.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.js

MediumOversized Cli Entrypointdist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to openkrak-mcp@1.1.2.

See all versions of openkrak-mcp for other recorded verdicts.

Review the evidence and your use of openkrak-mcp@1.1.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 12:10:58.928Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.