@azure/mcp-darwin-x64

AI Security Review

Evidence context: threat category none; evidence quality strong.

The @azure/mcp-darwin-x64 package is a compiled binary implementation of the Azure MCP Server for macOS. The scanner flagged over 11,000 indicators of compromise, but a close look at the actual findings reveals they are entirely artifacts of parsing a compiled executable and its embedded resources.

There are zero tool-poisoning findings. The threat data explicitly shows no tool-poisoning, no malware signatures, and no network connections. This means the code does not contain hidden directives aimed at manipulating an AI agent's behavior. For an MCP server, the absence of tool-poisoning is the most important baseline check, and this package passes it cleanly.

The network endpoints extracted by the scanner are a dead giveaway that the IoC extractor is misinterpreting binary data. Entries like 6system.net.security, aazure.identity.broker, and 4azure.search.documents.indexes.models.bm are not web domains. They are .NET namespaces and internal class paths that happen to contain dots. Similarly, endpoints like 1-extract-insights.md and 2-research-best-practices.md are markdown filenames embedded in the binary, not URLs. The actual domain findings, such as reference.dotnet.withtracing.md and t.ma, are either documentation references or truncated strings. None of these represent outbound network calls to unknown or suspicious infrastructure.

The 197 code-smell findings are equally benign. They stem from YARA rules matching standard runtime patterns within the bundled dependencies or the binary itself. Without any accompanying credential-access or network-exfiltration findings, these code-smell hits are just noise.

There are no secret or credential-access findings. The package does not read .ssh, .aws, or .kube directories. It does not harvest environment variables to send to external servers. The zero count in the secret and network categories confirms the binary does not exhibit exfiltration behavior.

The strongest counterargument to clearing this package is the sheer volume of medium-severity IoC findings. Over 11,000 SHA256 hashes and domain strings were flagged, which usually warrants deep suspicion. However, the nature of these findings completely undermines their severity. The SHA256 hashes in extracted_from_files are simply hashes of the internal components, resources, or dependencies bundled within the binary. The "domains" are namespaces and filenames. When the scanner parses a compiled binary as if it were plain text, it will inevitably generate thousands of false positives.

Given the publisher is microsoft1es, the package name matches the official Azure MCP tooling, and the findings are entirely explained by binary string extraction, this package is safe. The scanner tripped on the compiled nature of the payload, not on any malicious behavior.

Key Reasons

• Zero tool-poisoning findings despite 11,000+ total IoC alerts
• Extracted network endpoints are .NET namespaces and markdown filenames, not real domains
• No credential-access or secret findings targeting .ssh, .aws, or environment variables
• Zero actual network connections or malware signatures detected
• Publisher microsoft1es aligns with official Azure tooling

False Positive Considerations

• IoC extractor parsing compiled binary strings as domains
• YARA code-smell rules matching standard .NET runtime patterns
• SHA256 hashes of internal bundled resources flagged as suspicious
• Markdown filenames embedded in binary misidentified as URLs

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 95%.