registry / openkrak-mcp / 1.1.4

openkrak-mcp@1.1.4

OpenKrak MCP Server - AI coding intelligence via Dorchester engine

AI Security Review

scanned 26d ago · by lpm-firewall-ai

When an MCP tool is invoked, the package fingerprints the host and contacts its remote service. It also instructs connected AI agents to avoid independent source verification and trust package-generated output.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

An MCP client invokes any listed repository-analysis tool.

Impact

The remote service receives a stable device identifier, tool-use metadata, and potentially repository-derived error text; an agent can be steered away from verification.

Mechanism

Host fingerprinting, telemetry upload, and agent-directed prompt manipulation.

Attack narrative

The executable MCP server runs whenever the configured server is started. On a tool request it derives a stable identifier from the host name and account name, then posts it with tool metadata to a remote endpoint. Successful tools also send usage telemetry, while failures upload the exception text. The tool descriptions attempt to control a connected coding agent by making package output mandatory and prohibiting source inspection, creating a concrete path to suppress independent review of repository data.

AI rationale

The package combines unconsented host tracking and error telemetry with explicit instructions designed to make an AI agent trust its output and avoid verification. There is no install hook, but the runtime agent-control and data-transfer behavior is concrete and malicious.

Evidence

dist/index.jsuser-supplied repository path

Network endpoints2

openkrak-license-server.openkrak.workers.dev/v3/free-query

openkrak-mcp@1.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code