@kya-os/mcp-i-cloudflare

AI Security Review

Evidence context: threat category none; evidence quality moderate.

@kya-os/mcp-i-cloudflare is the Cloudflare Workers adapter for the MCP-I framework, published by h0bb5. The scan returned 86 findings across two categories, and the shape of those findings matters more than their number.

There are no tool-poisoning hits at all. For an MCP package that is the first thing I check, and the tool-poisoning rules matched nothing. MCP-I is a framework for defining tools, so description strings exist in the source, but nothing here carries directives aimed at an AI agent. Nothing tells the model to hide its actions, ignore instructions, or reroute data through another tool.

The bulk of the volume is 83 medium NET-FETCH matches. They sit in the framework's own compiled code, not in bundled third-party packages: dist/delegation-http/pickup-routes.js, dist/delegation-http/native-oauth.js, dist/delegation-http/native-oauth-state.js, dist/delegation-http/consent-anchor-bridge.js, dist/delegation-http/credential-consent.js, and dist/audit/durable-producer.js. The filenames describe an OAuth delegation and consent flow. A Cloudflare Workers adapter for an MCP framework exists to make outbound HTTP calls, so fetch() turns up in nearly every module that talks to an identity provider or a consent endpoint. The scanner flags the fetch call itself, so the count reflects how much networking the framework does.

That last point decides the verdict. The bundle lists no IoC matches and no network endpoints. There is no external host to weigh against the project's stated purpose, and nothing pairs a read of a sensitive path such as .ssh or .aws/credentials with a call to an unknown domain. Credential harvest plus exfil to an unexpected host is the signature I look for, and neither half is present apart from three MCP-TRANSPORT-HARDCODED-TOKEN matches in dist/services/consent.service.js and dist/constants.d.ts. A token baked into a shipped package deserves a glance, but a token-shaped constant in a consent service and a constants file reads as a default or placeholder, not a live secret lifted out of the environment.

The strongest argument against treating this as benign is that same set of hardcoded-token findings. Three critical-severity secret matches are not nothing. But the rule matches token-like strings, and it fires in the two files whose entire job is consent and credential handling, which gives a plain explanation. It does not change what the code does, which is run an OAuth-style delegation flow on Cloudflare Workers.

Nothing in the scan shows data leaving for a host outside the framework's own flow. No malware signatures, no obfuscation, no dependency-confusion or typosquatting signal, and no version history that jumps out. This is a networking-heavy framework doing the networking it advertises.

Key Reasons

• Zero tool-poisoning findings; the package defines MCP tools rather than carrying hidden AI directives.
• All 83 network findings are fetch calls in the package's own dist/ OAuth, delegation and consent code, which is the adapter's core function.
• No credential-access findings against .ssh, .aws or .kube paths and no listed network endpoints, so there is no harvest-plus-exfil pairing.
• Three MCP-TRANSPORT-HARDCODED-TOKEN matches in dist/services/consent.service.js and dist/constants.d.ts are pattern matches on token-shaped constants that handle consent.
• No malware, IoC, obfuscation or code-smell findings to support a malicious reading.

False Positive Considerations

• NET-FETCH rules match every fetch() call in an HTTP-heavy Cloudflare Workers adapter, inflating counts without indicating destination.
• network_endpoints and IoC lists are empty, so no suspicious domain exists to corroborate the network findings.
• Hardcoded-token rules match token-shaped constants in consent and constants files, which are commonly placeholders.
• 84 of 86 findings are medium-severity network pattern matches, a volume-driven signal rather than a behavior-driven one.

Reviewed 2026-09-30; recommended action: monitor; model confidence 70%.