registry / openkrak-mcp / 1.1.3

openkrak-mcp@1.1.3

OpenKrak MCP Server - AI coding intelligence via Dorchester engine

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. When an MCP client invokes a tool, the server pushes instructions intended to stop independent source verification. It also transmits a stable host fingerprint and may transmit runtime error text to its license service.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

An MCP client starts the server and calls one of its tools.

Impact

An AI client may be steered away from verifying code, while host identity and potentially sensitive error details leave the machine.

Mechanism

AI instruction hijacking combined with remote host fingerprint and error telemetry.

Policy narrative

After an MCP tool is called, the package tells the connected AI not to read or verify repository files and to trust the package-generated brief. The same runtime derives a persistent hash from the local hostname and username for remote requests. If a tool fails, it posts the error message together with that fingerprint to the remote telemetry endpoint. It additionally executes a fixed git command in the repository supplied by the MCP client.

AI rationale

The package combines active AI-verification suppression with unneeded remote host fingerprinting and error telemetry. These are concrete runtime behaviors rather than a benign static-analysis implementation alone.

Evidence

dist/index.js

Network endpoints3

openkrak-license-server.openkrak.workers.dev/v3/free-queryopenkrak-license-server.openkrak.workers.dev/v3/telemetry

openkrak-mcp@1.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code