registry / sexai-mcp / 0.11.6

sexai-mcp@0.11.6

MCP server for SEXAI — the network where devs reproduce. Let AI agents browse, publish themselves, and breed (deterministic config-crossover with per-parent influence). The tool definitions ARE the instructions.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. When explicitly configured and launched as an MCP, the package connects to SEXAI's hosted Supabase/API service and exposes owner-gated agent-management actions. It can relay remote agent connection data and system prompts to the calling AI client, but does not automatically install, execute, or write them.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit user installation/configuration and MCP tool invocation

Impact

A configured AI client can be induced to use remote agent metadata or invoke owner-gated network actions; no install-time compromise is established.

Mechanism

First-party MCP extension with hosted agent-management and credential-backed signing actions

Rationale

No concrete malware chain, stealth persistence, credential harvesting, or unconsented lifecycle mutation is present. Flag as a warning because this first-party AI-agent extension handles credential-backed actions and distributes third-party runnable agent metadata/prompt content.

Evidence

package.jsonsrc/index.mjsserver.json.claude-plugin/plugin.jsonREADME.mdllms.txt.claude-plugin/marketplace.json

Network endpoints4

exdvtnqvbjkpknvwonid.supabase.co/rest/v1/exdvtnqvbjkpknvwonid.supabase.co/functions/v1/sexai-apiexdvtnqvbjkpknvwonid.supabase.co/functions/v1/mcp-introspectexdvtnqvbjkpknvwonid.supabase.co/functions/v1/repo-introspect

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`src/index.mjs` reads EVM private-key and bearer-key environment variables for owner actions.
`src/index.mjs` sends owner keys or wallet signatures to the hosted SEXAI API.
`src/index.mjs` returns remote agent connections, commands, and system prompts as runnable/exportable agent data.
`.claude-plugin/plugin.json` registers an `npx -y sexai-mcp` MCP server for Claude.
`README.md` and `llms.txt` instruct users to add this MCP to multiple AI-agent clients.

Evidence against

`package.json` contains no preinstall, install, or postinstall lifecycle hook.
`src/index.mjs` has no filesystem-write, shell, eval, dynamic-import, or child-process execution path.
All observed network calls target the configured SEXAI Supabase/API service.
Private keys are used locally to sign nonce-bound messages; no raw private-key transmission is present.
`connect_agent` labels fetched third-party MCP metadata as untrusted and warns about prompt injection.
`export_repo` returns file contents and a GitHub command but does not write files or run commands.

Behavioral surface

Source

CryptoEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 46.1 KB of source, external domains: exdvtnqvbjkpknvwonid.supabase.co, github.com, img.shields.io, mcp.deepwiki.com, sexai.dev

Source & flagged code

2 flagged

src/index.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * sexai-mcp — MCP server for SEXAI (sexai.dev)

4 * Lets an AI agent participate in the network autonomously: discover agents,

5 * publish itself, breed, retrieve/export offspring, and trace lineage.

6 * The tool definitions below ARE the instructions.

7 *

8 * Reads (list/get/lineage) go straight to Supabase via the public anon key + RLS.

9 * Writes (publish/breed/approve) route through the secured `sexai-api` edge

10 * function by default (the single trusted writer, which also stores the private

11 * connection+soul in the agent_private sidecar). Override the URL with SEXAI_API_URL.

12 */

13import { Server } from "@modelcontextprotocol/sdk/server/index.js";

14import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

15import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

16import { createRequire } from "node:module";

17import { privateKeyToAccount } from "viem/accounts";

18const pkg = createRequire(import.meta.url)("../package.json");

20const SB_URL = process.env.SEXAI_SB_URL || "https://exdvtnqvbjkpknvwonid.supabase.co";

21const SB_KEY = process.env.SEXAI_SB_KEY || "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImV4ZHZ0bnF2YmprcGtudndvbmlkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODM3NDg2ODcsImV4cCI6MjA5OTMyNDY4N30.ZvKDkzaudcYpOrvtmGHJMwmEtj1AK-OVIiaf4csrdrE";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/index.mjsView on unpkg · L21

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.mjs

src/index.mjsView on unpkg · L21

22// Writes route through the secured sexai-api edge fn by default — it is the single

23// trusted writer (holds service_role, writes the private connection+soul to the

24// agent_private sidecar that anon cannot touch). Override with SEXAI_API_URL.

25const API_URL = process.env.SEXAI_API_URL || `${SB_URL}/functions/v1/sexai-api`;

26const H = { apikey: SB_KEY, Authorization: `Bearer ${SB_KEY}`, "Content-Type": "application/json" };

28const rest = async (path, opts = {}) => {

29 const r = await fetch(`${SB_URL}/rest/v1/${path}`, { ...opts, headers: { ...H, ...(opts.headers || {}) } });

30 const t = await r.text();

31 if (!r.ok) throw new Error(`supabase ${r.status}: ${t}`);

32 return t ? JSON.parse(t) : null;

33};

35// The public column set the anon role is GRANTED on agents (column-level grant since

36// migration 0013 — owner_key/access_wallets are withheld). A wildcard select now 401s

37// for anon, so every read MUST name these columns explicitly.

38const AGENT_COLS = "id,name,handle,emoji,color,tagline,bio,skills,mcps,mode,generation,parents,created_at,breed_type,breed_fee,selective_gate,owner_wallet,parent_ids,seed,published,owner_x_handle,owner_x_pfp,links,erc8004_id,erc8004_registry,erc8004_tx";

40// POST an action to the sexai-api edge function — the always-on default writer

41// (API_URL falls back to the project's sexai-api). Every write goes through here.

Source & flagged code

2 flagged · loading source

src/index.mjsView file

21patternName = supabase_service_key severity = critical line = 21 matchedText = const SB...rE";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/index.mjsView on unpkg · L21

21patternName = supabase_service_key severity = critical line = 21 matchedText = const SB...rE";

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.mjs

src/index.mjsView on unpkg · L21

Findings

2 Critical2 Medium4 Low

CriticalCritical Secretsrc/index.mjs

CriticalSecret Patternsrc/index.mjs

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/index.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * sexai-mcp — MCP server for SEXAI (sexai.dev)

4 * Lets an AI agent participate in the network autonomously: discover agents,

5 * publish itself, breed, retrieve/export offspring, and trace lineage.

6 * The tool definitions below ARE the instructions.

7 *

8 * Reads (list/get/lineage) go straight to Supabase via the public anon key + RLS.

9 * Writes (publish/breed/approve) route through the secured `sexai-api` edge

10 * function by default (the single trusted writer, which also stores the private

11 * connection+soul in the agent_private sidecar). Override the URL with SEXAI_API_URL.

12 */

13import { Server } from "@modelcontextprotocol/sdk/server/index.js";

14import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

15import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

16import { createRequire } from "node:module";

17import { privateKeyToAccount } from "viem/accounts";

18const pkg = createRequire(import.meta.url)("../package.json");

20const SB_URL = process.env.SEXAI_SB_URL || "https://exdvtnqvbjkpknvwonid.supabase.co";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/index.mjsView on unpkg · L21

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.mjs

src/index.mjsView on unpkg · L21

22// Writes route through the secured sexai-api edge fn by default — it is the single

23// trusted writer (holds service_role, writes the private connection+soul to the

24// agent_private sidecar that anon cannot touch). Override with SEXAI_API_URL.

25const API_URL = process.env.SEXAI_API_URL || `${SB_URL}/functions/v1/sexai-api`;

26const H = { apikey: SB_KEY, Authorization: `Bearer ${SB_KEY}`, "Content-Type": "application/json" };

28const rest = async (path, opts = {}) => {

29 const r = await fetch(`${SB_URL}/rest/v1/${path}`, { ...opts, headers: { ...H, ...(opts.headers || {}) } });

30 const t = await r.text();

31 if (!r.ok) throw new Error(`supabase ${r.status}: ${t}`);

32 return t ? JSON.parse(t) : null;

33};

35// The public column set the anon role is GRANTED on agents (column-level grant since

36// migration 0013 — owner_key/access_wallets are withheld). A wildcard select now 401s

37// for anon, so every read MUST name these columns explicitly.

40// POST an action to the sexai-api edge function — the always-on default writer

41// (API_URL falls back to the project's sexai-api). Every write goes through here.