webcode bridge

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WebMCP Bridge (version 0.5.2) is a developer tool that connects web AI services to a local MCP (Model Context Protocol) gateway. The extension's behavior aligns with its stated purpose of integrating AI services.

IoC Analysis: The 70 IoC findings are predominantly benign. Domains like https://chatgpt.com/*, https://gemini.google.com/*, https://aistudio.google.com/*, and https://chat.deepseek.com/* are legitimate AI service endpoints that the extension legitimately connects to. The findings XIOC-DOMAIN-context.md and XIOC-DOMAIN-hint.md are clear false positives—these are file extensions, not domains. The three instances of XIOC-URL-http://127.0.0.1:$ reference loopback addresses for local MCP gateway communication, which is expected behavior for a tool connecting to local services.

Code Findings: The 27 code-smell findings are classified as noise per the CVEQ false-positive guidelines. These rules fire on basic JavaScript patterns and should not drive verdicts. Critically, there are 0 malware signatures, 0 obfuscation findings, and no credential-theft indicators.

Suspicious Domain: The domain r.top is the only finding that warrants scrutiny. However, without evidence of data exfiltration, credential access, or malicious behavior associated with this domain, it cannot be classified as malicious. Short domains are sometimes used legitimately for CDNs or API endpoints.

Counterargument: A skeptic might argue that the anonymous developer email ([email protected]) combined with the r.top domain and 100 total findings indicates potential risk. However, this reasoning conflates finding volume with threat severity. The extension has zero malware signatures, zero obfuscation, and its IoCs match its declared functionality. The developer being anonymous is common for developer tools and does not indicate malice without corroborating evidence of harmful behavior.

Conclusion: This extension's findings are driven by known false-positive patterns: legitimate AI service domains, file extensions misclassified as domains, loopback addresses, and code-smell noise. No evidence of intentional harm exists.

Key Reasons

• All major IoCs are legitimate AI service domains (chatgpt.com, gemini.google.com, deepseek.com)
• Zero malware signatures and zero obfuscation findings
• File extensions (context.md, hint.md) incorrectly flagged as domains
• Loopback addresses (127.0.0.1) are expected for local MCP gateway communication
• Code-smell findings are documented noise per CVEQ guidelines

False Positive Considerations

• Legitimate AI service domains flagged as IoCs
• File extensions misclassified as domains (context.md, hint.md)
• Loopback addresses (127.0.0.1) for local development
• Code-smell rules matching basic JavaScript patterns

Reviewed 2026-04-29; recommended action: suppress false positive; model confidence 75%.