@slayoffer/n8n-mcp

AI Security Review

Evidence context: threat category none; evidence quality strong.

Tool-Poisoning Assessment

The findings summary shows 0 tool-poisoning findings. This is the most critical indicator for MCP security. Tool poisoning—the defining MCP threat involving hidden AI manipulation directives—is absent. The package has no findings with titles containing hidden instructions, invisible Unicode characters, or directives aimed at AI agents. Without tool-poisoning findings, the primary MCP attack vector is not present.

Credential and Network Access

The findings summary shows 0 secret findings and no credential-access findings targeting sensitive paths like .ssh/, .aws/, .kube/, or specific secret names (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY). The 8 network findings are all located in the dist/ directory (bundled code): package/dist/mcp/tool-docs/workflow_management/n8n-executions.js:66, package/dist/services/config-validator.js:659, package/dist/templates/template-service.js:223, and similar paths. These files represent legitimate service code for an n8n integration, not exfiltration infrastructure.

The IoC findings (12,935 total) are documentation strings, not suspicious domains. Specific examples include https://developer.wordpress.org/rest-api/, https://docs.softr.io/softr-api/..., and https://n8n.io/workflows/.... These are legitimate API documentation URLs embedded in tool descriptions, not exfiltration endpoints. No IoC findings show unknown third-party domains that would indicate data exfiltration.

False Positive Drivers

The 12,935 IoC findings are IoC extractor noise from documentation strings in bundled dependencies. The dist/ directory contains webpack/esbuild-bundled code where every npm dependency triggers its own YARA/IoC matches. The 592 code-smell findings are low-severity patterns matching basic Node.js constructs. The 1 malware-signature finding with 0 actual malware findings is a false positive from bundled libraries.

Strongest Counterargument

The 12,935 IoC findings and 1 malware-signature finding could suggest malicious activity. However, IoC COUNT alone is meaningless in MCP packages—everything is bundled. The specific IoCs are legitimate documentation URLs, not suspicious domains. The malware-signature finding has no corresponding malware finding, indicating a YARA false positive from bundled dependencies. Without tool poisoning, credential theft, or suspicious network destinations, the high finding count does not indicate malice.

Key Reasons

• Zero tool-poisoning findings—the defining MCP threat is absent
• Zero secret/credential-access findings—no credential exfiltration architecture
• All 8 network findings in dist/ directory for legitimate n8n service code
• 12,935 IoC findings are documentation strings (WordPress, Softr, n8n API docs), not suspicious domains
• Package description matches functionality: n8n workflow automation integration

False Positive Considerations

• IoC extractor noise from documentation strings in tool descriptions
• Bundled dependencies in dist/ directory creating multiplicative false positives
• Code-smell YARA rules firing on standard Node.js patterns
• Malware-signature false positive from bundled libraries

Reviewed 2026-04-27; recommended action: no action; model confidence 85%.