@iflow-mcp/novitalabs-novita-mcp-server

AI Security Review

Evidence context: threat category none; evidence quality strong.

The package @iflow-mcp/novitalabs-novita-mcp-server is an MCP server designed to interact with the Novita AI API. We found zero tool-poisoning findings. There are no hidden instructions embedded in tool descriptions, no invisible Unicode characters, and no XML-style directive tags aimed at the AI agent. Tool poisoning is the defining threat in the MCP ecosystem, and this package shows no signs of attempting to manipulate the AI agent's behavior through its metadata.

Regarding credential and network access, the scanner did not flag any credential-access or secret-extraction findings. The package does not target sensitive paths like .ssh, .aws/credentials, or .kube/config. The single network finding, NET-FETCH-dist/utils.js-30, represents a standard HTTP fetch call. The extracted network endpoints include api.novita.ai, novita.ai, smithery.ai, glama.ai, modelcontextprotocol.io, claude.ai, and www.cursor.com. These domains are entirely expected for an MCP server integrating with Novita AI and distributed through MCP registries like Smithery and Glama, with documentation referencing Cursor and Claude. There is no combination of credential reads and network calls to unknown domains, which is the actual signature of an exfiltration architecture.

The strongest counterargument to a clean bill of health is the presence of 17 code-smell findings and 11 IoC extractions. A high volume of findings often warrants a closer look. However, the code-smell findings are low-severity matches for basic Node.js patterns like process.env reads and standard library usage. These rules fire on almost any non-trivial JavaScript and are classified as noise. The IoC extractions simply reflect the legitimate domains mentioned above, which the scanner logged because they appear in the bundled dist/ files. High finding counts in bundled distribution files are a known source of scanner noise, as every included library triggers its own set of matches. Without any credential harvesting targeting sensitive paths, and without network calls to unknown domains, there is no exfiltration architecture present. The developer, chatflowdev, published version 1.0.3 as a straightforward wrapper. The lack of malware signatures or obfuscation findings further supports that the code defines tools for its stated purpose without embedding secondary payloads or surveillance mechanisms. The scanner tripped on expected code patterns and bundled dependencies.

Key Reasons

• Zero tool-poisoning findings
• No credential-access or secret-extraction findings
• Network endpoints are all legitimate and expected
• Code-smell and IoC findings are standard scanner noise

False Positive Considerations

• code-smell rules matching standard Node.js patterns
• IoC extractions from legitimate API endpoints
• bundled dependencies in dist/ files

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 92%.