@kya-os/mcp

AI Security Review

Evidence context: threat category none; evidence quality strong.

Tool Poisoning Assessment

Zero tool-poisoning findings were detected. This is the most critical threat indicator for MCP packages, and its complete absence is a strong signal of benign code. The findings summary explicitly shows "tool-poisoning":"0" with no hidden AI manipulation directives, XML-style instruction tags, or invisible Unicode characters encoding covert instructions.

Credential and Network Access

The package has zero credential-access findings and zero secret findings. It does not read sensitive paths like .ssh/, .aws/credentials, .kube/config, or target specific secret names such as GITHUB_TOKEN or AWS_SECRET_ACCESS_KEY. The 8 network findings are all NET-FETCH calls in the dist/ folder (bundled code), specifically in dist/delegation/did-web-resolver.js and dist/providers/base.d.ts. These are legitimate fetch calls for DID (Decentralized Identifier) web resolution, which aligns with the package's stated purpose as a "KYA-OS protocol for Model Context Protocol servers: delegation, proof, and session primitives."

IoC Findings Are Noise

The 174 IoC findings are classic false positives from the XIOC extractor. Examples include:

• XIOC-DOMAIN-protocol.d.ts.map and XIOC-DOMAIN-crypto-service.js.map — source map files misidentified as domains
• XIOC-EMAIL-ended@${finaldelegation.id — a template string, not a real email
• XIOC-URL-https://keepachangelog.com/en/1.0.0/ and XIOC-URL-https://semver.org/spec/v2.0.0.html — documentation URLs
• XIOC-DOMAIN-schema.modelcontextprotocol-identity.io — a legitimate schema domain for MCP identity

None of these represent suspicious external domains for exfiltration. The IoC extractor is matching .js.map and .d.ts.map file extensions as "domains," which is documented noise.

Strongest Counterargument

The anonymous developer name "h0bb5" and zero user count could suggest an unvetted package. However, the absence of any actual malicious patterns (no tool poisoning, no credential theft, no malware signatures, no obfuscation) outweighs this concern. The package implements a legitimate protocol (KYA-OS for MCP delegation and identity), and all findings are explainable as scanner noise on source maps and documentation references.

Conclusion

This package exhibits no evidence of malicious intent. The 192 total findings are entirely attributable to IoC extractor false positives on source map files and benign documentation URLs, combined with legitimate network calls in DID resolver code. The zero tool-poisoning and zero credential-access counts are definitive indicators of a benign implementation.

Key Reasons

• Zero tool-poisoning findings (the defining MCP threat)
• Zero credential-access and zero secret findings
• All IoC findings are false positives from source map files and documentation URLs
• Network calls are in legitimate DID web resolver code
• Zero malware signatures and zero obfuscation findings

False Positive Considerations

• XIOC extractor matching .js.map and .d.ts.map files as domains
• Documentation URLs (keepachangelog.com, semver.org) flagged as IoCs
• Template strings misidentified as email addresses
• Bundled dist/ folder triggering network findings on legitimate fetch calls

Reviewed 2026-05-25; recommended action: suppress false positive; model confidence 85%.