registry / zeronews-mcp / 0.1.2
zeronews-mcp@0.1.2
ZeroNews MCP connector (stdio) — wraps the zeronews CLI for Cursor / WorkBuddy
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe source shows a user-invoked, package-aligned client installation flow and no automatic install hook or independent attack behavior. The Linux installer’s disabled certificate verification is a security concern, but the inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller invokes the install_client tool when the ZeroNews client is missing.
Impact
This installs the intended ZeroNews client. No unrelated credential transfer, persistence, or destructive action was identified.
Mechanism
The installer downloads a platform-specific client from the ZeroNews download host; its Linux branch runs the downloaded installer script with a supplied auth token.
AI rationale
The source shows a user-invoked, package-aligned client installation flow and no automatic install hook or independent attack behavior. The Linux installer’s disabled certificate verification is a security concern, but the inspected source does not establish malicious behavior.
Evidence
dist/server.jsdist/tools/install-client.jsdist/download-zeronews.js
Network endpoints1
download.zeronews.cc
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a prepublishOnly test script and no automatic install hook.
- Installation is exposed as an MCP tool; the downloader runs only when the local client is missing and installation is enabled.
- The installer uses the ZeroNews download host and selects a platform-specific installer; Linux requires an auth token.
- The inspected SDK implements MCP tool requests over stdio, consistent with the package’s stated connector purpose.
- The SDK and Zod manifests show ordinary build and test scripts, and the Zod entrypoint re-exports its validation library.
Evidence against
- The Linux installer pipes a downloaded script to a shell and disables TLS certificate checking, but this occurs in the explicit client-install flow and targets the package’s stated service.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/download-zeronews.jsView file
2import path from "node:path";
L3: import { execFile } from "node:child_process";
L4: import { promisify } from "node:util";
...
L6: const execFileAsync = promisify(execFile);
L7: const DOWNLOAD_BASE = "https://download.zeronews.cc";
L8: export function macosDownloadUrl(cpuArch = process.arch) {
L9: const slug = cpuArch === "arm64" ? "arm" : "amd";
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/download-zeronews.jsView on unpkg · L2package.jsonView file
44est && node scripts/pack-connector.mjs",
"pack:expert": "node scripts/pack-expert.mjs",
"pack:workbuddy": "npm run pack:connector && npm run pack:expert",
"prepublishOnly": "npm test"
},
"engines": {
"node": ">=20"
},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.12.1",
"zod": "^3.24.2"
},
"devDependencies": {
"@types/node": "^22.13.10",
"
Low
Suspicious Lifecycle Evidence
package.json defines a prepublishOnly test script and no automatic install hook.
package.jsonView on unpkg · L44Findings
1 High3 Medium8 Low
HighSandbox Evasion Gated Capabilitydist/download-zeronews.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/server.js
LowAi Review Evidencedist/tools/install-client.js
Affected versions and remediation
This report applies to zeronews-mcp@0.1.2.
See all versions of zeronews-mcp for other recorded verdicts.
- Review the evidence and your use of zeronews-mcp@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.