mcp-proxy

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Tool Poisoning Assessment: The findings summary shows 0 tool-poisoning findings. This is the critical metric for MCP server security. Tool poisoning is the defining threat for MCP packages, involving hidden AI manipulation directives embedded in tool descriptions. With zero findings in this category, there is no evidence of hidden instructions aimed at manipulating AI agent behavior.

Credential and Network Access: The findings summary shows 21 secret findings and 27 network findings, but the evidence bundle does not contain specific credential-access findings targeting sensitive paths like .ssh/, .aws/credentials, .kube/config, or application_default_credentials.json. The IoC findings are exclusively documentation and issue tracker URLs: https://developer.mozilla.org/docs/Web/API/EventSource/, https://github.com/sindresorhus/get-east-asian-width/pull/6, https://openid.net/specs/openid-connect-discovery-1_0.html, and http://stackoverflow.com/questions/13227489. The only non-documentation domain is https://tunnel.gla.ma, but without code evidence showing this domain is used for data exfiltration combined with credential harvesting, this is likely a dependency reference. The combination of credential reads + network calls to unknown domains is the exfiltration signal—neither alone is sufficient, and neither is present here.

False Positive Drivers: The 760 total findings are inflated by bundled dependencies. The IoC count of 555 consists of documentation URLs from standard npm packages. The 95 malware-signature findings are typical for bundled node_modules in dist/ files. The package description states it is "A TypeScript SSE proxy for MCP servers that use stdio transport"—legitimate infrastructure code that orchestrates MCP tool definitions rather than poisoning them.

Strongest Counterargument: The developer name "GitHub Actions" is unusual and could indicate automated or anonymous publishing. However, this alone does not constitute malicious behavior. The package serves a legitimate infrastructure purpose (SSE proxy for stdio transport), has zero tool-poisoning findings, and the IoC findings are all benign documentation references. The high finding count is expected for any MCP package with bundled dependencies and does not indicate malicious intent.

Conclusion: This is a legitimate MCP infrastructure package. The high finding counts are false positives from bundled code and documentation URLs. No evidence of tool poisoning, credential theft, or data exfiltration architecture.

Key Reasons

• Zero tool-poisoning findings in a package with 760 total findings
• All IoC findings are documentation/issue tracker URLs, not exfiltration endpoints
• No credential-access findings targeting sensitive paths (.ssh, .aws, .kube)
• Package description indicates legitimate infrastructure purpose (SSE proxy for stdio transport)

False Positive Considerations

• Bundled dependencies generating high IoC and malware-signature counts
• Documentation URLs from npm package metadata
• Code-smell findings from standard Node.js patterns
• Minified/bundled JavaScript triggering YARA rules

Reviewed 2026-04-27; recommended action: no action; model confidence 85%.