@stigmer/mcp-server

AI Security Review

Evidence context: threat category tool poisoning; evidence quality moderate.

@stigmer/mcp-server v3.41.0 comes from publisher whysosuresh and wires Stigmer agents, skills, MCP servers and workflows into an AI agent as MCP tools and resources. The package name fits the vendor scope, and version 3.41.0 points at a mature release line rather than a fresh typosquat.

Tool poisoning. Three critical findings share one title pattern: MCP-TOOL-TOOL-POISONING-cli/mcp-server-stigmer.js-198, plus two more at line 204. This is the defining MCP threat, so it deserves the attention. What we can see points away from live hidden directives. The hits sit on two adjacent lines inside a bundled CLI file, exactly where tool registration code attaches descriptions to tool objects. Two identical findings on the same line normally mean one pattern matched twice, not two separate payloads. Nothing in the evidence shows directive text aimed at a model, such as "do not tell the user" or "ignore previous instructions". Verdict on this threat: unproven. A human needs to read lines 198 and 204 and judge the description strings.

Credentials and network. No credential-access findings at all. Nothing touches .ssh, .aws/credentials, .kube/config or application_default_credentials.json, and no secret findings matched. The four NET-FETCH hits sit in src/domains/resourcehandler.ts at lines 57 and 75, and in its build output domains/resourcehandler.js at lines 16 and 24. Resource handlers are a normal place for an MCP server to call the platform API. The one endpoint matching the package's stated purpose is agentic.stigmer.ai, the vendor's own service. The rest of the endpoint list, acme.com, console.info, input.do, cxt.it, cst.bom, idempotencylevel2.no, executiontarget2.cloud, reads as the IoC extractor splitting JavaScript property chains and protobuf identifiers into fake hostnames. No harvest-plus-exfil architecture appears anywhere in this package.

Obfuscation. OBFUSCATION-large_base64 fires on cli/mcp-server-stigmer.js. A large base64 string inside a shipped CLI bundle usually holds an embedded asset, and zero malware signatures matched across the whole package.

Severity context. Of 438 findings, 379 carry low severity and the code-smell label, the kind that match any non-trivial JavaScript referencing fetch, process.env or fs. Another 50 are IoC noise. Malware and secret counts are both zero.

The counterargument. The strongest case against my read: tool poisoning hides best, the scanner flagged three critical hits in a single file, and we cannot see the description strings ourselves. A hostile server would look identical at the metadata level. That does not change the conclusion. A vendor MCP server with no credential reads, no exfiltration destination and a first-party network target has a benign explanation for every finding, while the one genuinely unresolved item is a code read, not a behaviour we can infer from file paths alone.

Key Reasons

• Three critical MCP-TOOL-TOOL-POISONING hits cluster on two adjacent lines (198, 204) of the bundled CLI file, consistent with tool registration code rather than distinct payloads
• Zero credential-access findings: no .ssh, .aws/credentials, .kube/config or application_default_credentials.json reads
• Only network destination matching the package's purpose is agentic.stigmer.ai, the vendor's own service, with the remainder reading as IoC property-chain noise
• No malware signatures and no secret findings; 379 of 438 findings are low-severity code-smell hits on bundled JavaScript
• Tool descriptions themselves are not visible in the evidence, so the poisoning hits cannot be confirmed or dismissed without reading lines 198 and 204

False Positive Considerations

• IoC extractor splitting property chains and protobuf identifiers into fake hosts (console.info, input.do, cxt.it, idempotencylevel2.no)
• 379 low-severity code-smell hits typical of any bundled JavaScript
• Large base64 blob in a shipped CLI bundle flagged as obfuscation
• Duplicate tool-poisoning finding on the same line (204) indicating a repeated pattern match

Reviewed 2026-09-30; recommended action: reanalyze; model confidence 60%.