@kya-os/create-mcpi-app

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What the package does

@kya-os/create-mcpi-app (version 1.12.1, published by h0bb5) is a scaffolding CLI. It writes a starter MCP-I project to disk and bundles four example apps under dist/bundles/ to show the shape of a finished project.

Tool poisoning

Nothing. The tool-poisoning bucket is empty, which matters most here. No tool description carries instructions aimed at an AI agent, no tool name hides invisible Unicode, and no metadata block wraps directives in XML tags. For an MCP-adjacent package that is the headline result, and it is negative.

Credential access

Thirty-nine findings carry the title MCP-TRANSPORT-HARDCODED-TOKEN, and each one lands in a bundled template: dist/bundles/blank.95bd4bbfb5f3fb70083ced77751677518931b0bff01a0fe9544fe3385f9d2e04.js (ten times), dist/bundles/ecommerce.ac9548d7ed449ef22996d1ad59be5e2be3a690c244ab0c911a4f634c36131290.js, dist/bundles/hardware-world.0b1b0776b93ec3e787ed65386a1e2af09cb30f99db84a9d310d259e97e3b842b.js, and dist/bundles/mix-station.400dd62895aac28ae60f9e9dc4c344f287f4999327b2b10a9035621198fb8cae.js. Those names map to the demo apps the generator emits. The transport rule looks for token-shaped strings in MCP client setup code, and template code is full of placeholder tokens for exactly that reason. Nothing reads ~/.ssh/id_rsa, ~/.aws/credentials, ~/.kube/config or application_default_credentials.json, and nothing enumerates AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN or OPENAI_API_KEY.

Network

The 157 network findings read as noise on inspection. The destination list holds console.info, chunk.delta, binding.review, action.pin, configuration.capabilities.delivery, and a markdown filename, 2026-07-29-consent-approve-auth-gate-design.md, lifted out of a docs file. These are property access chains the extractor split on a dot. The genuinely resolvable entries are claude.ai and app.anthropic.com, both of which are what an MCP scaffold is supposed to talk to. No POST goes to a host outside the package's purpose, so the harvest-then-exfiltrate shape is absent.

The strongest counterargument

Thirty-nine critical secrets is a lot of red on a scorecard, and the fair reading is that a generator shipping a hardcoded transport token in its template teaches every generated project to do the same. That is a hygiene problem worth an upstream issue. It is not exfiltration: no credential path is read, no unexpected host receives anything, and the 201 code-smell hits plus 252 IoC hits come from minified bundles rather than from behavior. Zero malware signatures, zero obfuscation findings, and empty permissions and host_permissions arrays round this out.

Key Reasons

• Zero tool-poisoning findings: no hidden AI directives in any tool metadata
• All 39 critical MCP-TRANSPORT-HARDCODED-TOKEN findings sit in bundled template apps under dist/bundles/ (blank, ecommerce, hardware-world, mix-station)
• Network destinations are property chains (console.info, chunk.delta, codes.observer); the only real endpoints are claude.ai and app.anthropic.com
• No reads of .ssh, .aws/credentials, .kube/config or application_default_credentials.json, and no targeted secret env names
• No malware signatures, no obfuscation, no dependency findings; empty permissions and host_permissions

False Positive Considerations

• Bundled dist/ template apps trigger IoC and code-smell rules at volume
• IoC extractor splitting property access chains (console.info, chunk.delta) into fake domains
• MCP transport hardcoded-token rule matching placeholder tokens in template code
• Minified bundle JavaScript producing 201 code-smell hits unrelated to behavior

Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 72%.