registry / saldo-mcp / 0.1.5

saldo-mcp@0.1.5

Saldo local connector — read-only MCP bridge between Nordic bank accounts and AI assistants.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs saldo connect-claude, saldo init, saldo serve, or banking query commands.

Impact

Warn-level agent configuration mutation; no unconsented install-time hijack or exfiltration found.

Mechanism

User-invoked MCP registration and banking API connector

Rationale

Static inspection shows a legitimate read-only banking MCP connector with explicit Claude registration commands and package-aligned network endpoints. Because it mutates an AI-agent control surface only via a user-invoked command and has no install-time hijack or malicious chain, downgrade to warn rather than block.

Evidence

package.jsondist/cli/index.jsdist/util/claude-config.jsdist/cli/init.jsdist/config.jsdist/broker-client.jsdist/providers/enablebanking/client.jsdist/mcp/server.js.env.example~/.saldo/config.json~/.saldo/broker-device.json~/.saldo/cache.sqlite~/.saldo/cache.keyClaude Desktop claude_desktop_config.json

Network endpoints4

api.enablebanking.comsaldo-broker.up.railway.applocalhost:8888/callback127.0.0.1:{port}/mcp

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Benign with medium false-positive risk.

Evidence for warning

dist/cli/index.js exposes user-invoked connect-claude/disconnect-claude commands.
dist/util/claude-config.js writes Claude Desktop mcpServers.saldo and runs claude mcp add/remove for Claude Code.
dist/cli/init.js can write ~/.saldo/config.json with managed broker or self-host Enable Banking credentials.

Evidence against

package.json has no preinstall/install/postinstall hooks; only prepublishOnly build.
Claude config mutation is explicit CLI action, not install-time or import-time behavior.
MCP tools in dist/mcp/server.js are read-only account/balance/transaction queries.
Network use is package-aligned: Enable Banking API and configured/Saldo broker.
No eval/vm/Function, remote payload loading, credential harvesting, or broad file scanning found.
.env.example contains placeholder PEM text, not a real secret.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 80.8 KB of source, external domains: 127.0.0.1, api.enablebanking.com, nodejs.org, saldo-broker.up.railway.app

Source & flagged code

3 flagged

.env.exampleView file

Lines 3-34text

3# need any EB_* values here — the broker holds the Enable Banking key and mints

4# tokens. Leave it unset for self-host mode (bring your own EB app, below).

5# SALDO_BROKER_URL=https://localhost:9443

7# Where the connector stores link/device state (which accounts are connected).

8# No transaction data is ever written here. Defaults to ~/.saldo

9# SALDO_DATA_DIR=/Users/you/.saldo

11# --- Enable Banking (https://enablebanking.com) ---

12# 1. Create a free account and register an Application in the control panel.

13# 2. Note the Application ID and download its RSA private key (.pem).

14# 3. Register the redirect URL below in the application settings (it must match).

15# On the free "Restricted Production" tier you can link your OWN accounts without

16# a contract; serving other users requires a signed contract + KYB.

18EB_APPLICATION_ID=

19# Inline PEM (the same variable the broker/Railway use). In a .env file put it on

20# one line with \n escapes (un-escaped at load); a real multi-line PEM also works.

21# Convert your .pem to the escaped one-liner with:

22# awk 'NF {printf "%s\\n", $0}' your_key.pem

23EB_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L23

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L23

25# Loopback URL the bank redirects to after authentication. Must exactly match the

26# redirect URL registered in the Enable Banking application. Enable Banking

27# requires https, so the connector serves this with a self-signed localhost cert

28# (your browser shows a one-time "not trusted" warning — click through).

29EB_REDIRECT_URL=https://localhost:8888/callback

31# --- Tink (future) ---

32# TINK_CLIENT_ID=

33# TINK_CLIENT_SECRET=

dist/providers/enablebanking/mappers.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { toMinorUnits } from "../../util/money.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/enablebanking/mappers.jsView on unpkg · L1

3/**

4 * Enable Banking identifies a bank by (name, country), not a single opaque id.

5 * We encode both into our Institution.id as "COUNTRY:Name" so createLink can

6 * reconstruct the aspsp. (Bank names may contain spaces — quote them on the CLI.)

Source & flagged code

3 flagged · loading source

.env.exampleView file

23patternName = private_key_rsa severity = critical line = 23 matchedText = EB_PRIVA...-\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L23

23patternName = private_key_rsa severity = critical line = 23 matchedText = EB_PRIVA...-\n"

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L23

dist/providers/enablebanking/mappers.jsView file

1import { createHash } from "node:crypto"; L2: import { toMinorUnits } from "../../util/money.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/enablebanking/mappers.jsView on unpkg · L1

Findings

2 Critical2 Medium6 Low

CriticalCritical Secret.env.example

CriticalSecret Pattern.env.example

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/providers/enablebanking/mappers.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

.env.exampleView file

Lines 3-34text

3# need any EB_* values here — the broker holds the Enable Banking key and mints

4# tokens. Leave it unset for self-host mode (bring your own EB app, below).

5# SALDO_BROKER_URL=https://localhost:9443

7# Where the connector stores link/device state (which accounts are connected).

8# No transaction data is ever written here. Defaults to ~/.saldo

9# SALDO_DATA_DIR=/Users/you/.saldo

11# --- Enable Banking (https://enablebanking.com) ---

12# 1. Create a free account and register an Application in the control panel.

13# 2. Note the Application ID and download its RSA private key (.pem).

14# 3. Register the redirect URL below in the application settings (it must match).

15# On the free "Restricted Production" tier you can link your OWN accounts without

16# a contract; serving other users requires a signed contract + KYB.

18EB_APPLICATION_ID=

19# Inline PEM (the same variable the broker/Railway use). In a .env file put it on

20# one line with \n escapes (un-escaped at load); a real multi-line PEM also works.

21# Convert your .pem to the escaped one-liner with:

22# awk 'NF {printf "%s\\n", $0}' your_key.pem

23EB_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L23

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L23

25# Loopback URL the bank redirects to after authentication. Must exactly match the

26# redirect URL registered in the Enable Banking application. Enable Banking

27# requires https, so the connector serves this with a self-signed localhost cert

28# (your browser shows a one-time "not trusted" warning — click through).

29EB_REDIRECT_URL=https://localhost:8888/callback

31# --- Tink (future) ---

32# TINK_CLIENT_ID=

33# TINK_CLIENT_SECRET=

dist/providers/enablebanking/mappers.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { toMinorUnits } from "../../util/money.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/enablebanking/mappers.jsView on unpkg · L1

3/**

4 * Enable Banking identifies a bank by (name, country), not a single opaque id.

5 * We encode both into our Institution.id as "COUNTRY:Name" so createLink can

6 * reconstruct the aspsp. (Bank names may contain spaces — quote them on the CLI.)