@kya-os/mcp-i-core

AI Security Review

Evidence context: threat category none; evidence quality strong.

The package @kya-os/mcp-i-core is a compatibility shim that re-exports runtime and W3C Verifiable Credentials delegation modules, directing users to the product layer at @kya-os/mcp-i-runtime. When evaluating this package for tool poisoning, we find zero tool-poisoning findings. There are no hidden instructions, invisible Unicode characters, or XML-style tags embedded in tool descriptions aimed at manipulating an AI agent. This is expected for a library focused on cryptographic identity and delegation rather than AI tool orchestration.

Regarding credential scope, the evidence shows no credential-access findings. The package does not read sensitive paths like .ssh, .aws, or .kube, nor does it target specific environment variables like GITHUB_TOKEN or AWS_SECRET_ACCESS_KEY. There is no architecture present for harvesting secrets and exfiltrating them to an unknown domain. The package operates entirely within the bounds of a standard identity resolution library.

The network footprint consists of a single medium-severity finding, NET-FETCH-dist/delegation/did-web-resolver.js-73, which corresponds to a DID web resolver making HTTP requests. This is the expected behavior for a module resolving decentralized identifiers. The extracted network endpoints align with this purpose, including standard W3C and identity infrastructure like w3id.org, w3c-ccg.github.io, and schema.modelcontextprotocol-identity.io. The remaining endpoints are largely artifacts of the extraction process. Strings like app.post, date.now, and parsed.payload.vc are property access chains misidentified as domains by the IoC extractor. Entries like server1.com, server2.com, and issuer.com are placeholder domains typically found in test fixtures or documentation examples within W3C specification code.

The strongest counterargument to a clean verdict is the sheer volume of findings: 63 IoC matches and 78 code-smell hits. A high volume of alerts often warrants suspicion in the MCP ecosystem. However, the 78 code-smell findings are low-severity noise that trigger on standard Node.js patterns in bundled or minified JavaScript. The 63 IoC matches are entirely explained by the DID resolver's legitimate HTTP calls, combined with the extractor misidentifying JavaScript property chains and test placeholders as malicious infrastructure. There are zero malware signatures and zero secret findings.

Ultimately, this package is a benign compatibility shim. The scanner tripped on the expected network behavior of a decentralized identity resolver and the generic noise of bundled JavaScript. There is no evidence of credential theft, tool poisoning, or data exfiltration.

Key Reasons

• Zero tool-poisoning findings and no hidden AI directives
• No credential-access findings or sensitive path reads
• Single network finding corresponds to legitimate DID web resolution
• IoC matches are property access chains and test placeholders
• Code-smell findings are low-severity noise from bundled JavaScript

False Positive Considerations

• IoC extractor misidentifying property access chains as domains
• Test placeholder domains in W3C specification code
• Code-smell rules triggering on standard Node.js patterns in bundled JavaScript

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 92%.