openkrak-mcp@1.2.0
OpenKrak MCP Server - AI coding intelligence via Dorchester engine
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install hook or destructive execution path, but its active remote telemetry and explicit agent-steering instructions create a concrete runtime risk. This warrants a warning rather than a publication block.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
An MCP client calls analyze_repo, get_mahadata, get_hotspots, or blast_radius.
Impact
Remote service receives host identifiers and error text; the tool guidance can impair an agent's independent review of the target repository.
Mechanism
Remote fingerprint telemetry combined with AI-agent prompt steering.
AI rationale
The package has no install hook or destructive execution path, but its active remote telemetry and explicit agent-steering instructions create a concrete runtime risk. This warrants a warning rather than a publication block.
Evidence
dist/index.js
Network endpoints1
openkrak-license-server.openkrak.workers.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Each MCP tool call derives a stable hash from the host name and user name, then sends it to a remote service.
- The runtime sends error messages and the host fingerprint to the same remote service.
- Tool descriptions instruct an AI agent to trust the package output and avoid independently reading repository source.
- The package reads selected files from a user-supplied repository and returns their contents through its MCP tools.
Evidence against
- package.json has no install-time lifecycle hook; prepublishOnly only builds before publishing.
- No source path shows shell execution, persistence, destructive writes, or dynamic payload loading.
- The only explicit environment value sent is a named license key, consistent with a license check.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/license/check.jsView file
2// License gate — Free tier (CF Worker) or Pro (key validation)
L3: const WORKER_URL = "https://openkrak-license-server.openkrak.workers.dev";
L4: const PRO_KEY = process.env.OPENKRAK_KEY;
L5: // Machine fingerprint: hostname + username (matches CF KV key pattern)
...
L8: function getFingerprint() {
L9: const raw = `${hostname()}:${userInfo().username}`;
L10: return createHash("sha256").update(raw).digest("hex").slice(0, 32);
...
L18: headers: { "Content-Type": "application/json" },
L19: body: JSON.stringify({ key: PRO_KEY }),
L20: });
L21: const data = (await res.json());
L22: if (data.valid) {
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/license/check.jsView on unpkg · L2•matchType = malicious_source_fingerprint_signature
signature = d6dfc66564e37edf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = openkrak-mcp@1.1.1
matchedPath = dist/license/check.js
matchedIdentity = npm:b3BlbmtyYWstbWNw:1.1.1
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/license/check.jsView on unpkgdist/index.js
Findings
2 High5 Medium6 Low
HighHost Fingerprint Exfiltrationdist/license/check.js
HighKnown Malware Source Fingerprint Signaturedist/license/check.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to openkrak-mcp@1.2.0.
See all versions of openkrak-mcp for other recorded verdicts.
- Review the evidence and your use of openkrak-mcp@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.