openregister-mcp

AI Security Review

Evidence context: threat category none; evidence quality weak.

This MCP server for the Openregister API presents a 'CRITICAL' risk score of 100 due to high-volume findings from bundled dependencies, but core threat indicators are absent. There are 0 tool-poisoning findings, 0 secret/access-token findings, and 0 network threats flagged in the summary. The 172 IoC and 110 malware-signature findings are characteristic of the 'Bundled Dependencies' false-positive pattern, where minified vendor code in dist/ or node_modules/ triggers YARA rules and hex-string IoCs (e.g., IPv6 fragments like ::, misread property chains). The lack of tool-poisoning is the strongest signal of safety: this package defines tools rather than attempting to manipulate the AI agent via hidden descriptions.

For a developer, this package represents a standard API client. The credential scope is likely limited to the standard OPENREGISTER_API_KEY or similar environment variables required for API authentication (confirmed by the 'official' description), though no specific secret harvesting was flagged. The network destinations are presumably the official Openregister API endpoints; the lack of network findings suggests no suspicious C2 domains.

Key Reasons

• Zero tool-poisoning findings detected despite high risk score
• Findings concentrated in IoC (172) and Malware-signature (110) categories typical of bundled dependencies
• No secret or credential-access findings flagged
• Package claims to be the official server for Openregister API

False Positive Considerations

• High IoC count (172) likely from minified bundled JS code
• Malware-signature hits (110) matching generic code patterns in vendor libraries
• Risk score inflation from dependency noise rather than actual threats

Reviewed 2026-04-13; recommended action: suppress false positive; model confidence 85%.