agentic-flow

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Tool-Poisoning Assessment

The evidence shows 8 tool-poisoning findings, but these are false positives from legitimate tool definitions. This package is an AI agent orchestration SDK that defines 213 MCP tools. Tool definitions in SDK libraries naturally contain description fields that scanners flag as potential poisoning. The finding count is small (8) relative to the 6896 total findings, and there is no evidence of hidden AI manipulation directives such as "do not tell the user," "silently execute," or XML-style instruction tags. Real tool poisoning contains DIRECTIVES aimed at the AI agent; this package contains DESCRIPTIONS aimed at developers.

Credential and Network Access

The 6 secret findings are not detailed in the evidence, but critically, there are NO credential-access findings targeting sensitive paths like .ssh/, .aws/credentials, .kube/config, or application_default_credentials.json. The network findings all originate from dist/ directory files (bundled/compiled code): dist/sdk/plugins.js:108, dist/swarm/p2p-swarm-v2.js:510, dist/proxy/quic-proxy.js:151, dist/proxy/anthropic-to-requesty.js:144, dist/services/embedding-service.js:108, dist/intelligence/agent-booster-enhanced.js:961, and dist/router/providers/openrouter.js:17. These file names indicate legitimate functionality: plugin systems, P2P swarm communication, QUIC proxy, Anthropic integration, embedding services, and OpenRouter provider. The exfiltration signal requires the COMBINATION of credential reads targeting secrets plus network calls to unknown domains. Neither condition is met here.

Strongest Counterargument

The developer "ruvnet" is an unknown publisher with 0 users, which increases suspicion in the MCP ecosystem. However, the finding NATURE does not support malicious intent. The 3614 IoC findings are SHA256 hashes without domain context (IoC extractor garbage). The 2588 malware-signature findings are from bundled dependencies in dist/ files. The 62 code-smell findings are noise from YARA rules matching basic Node.js patterns. None of these indicate actual malicious behavior.

Conclusion

This is a legitimate MCP SDK library. The massive finding volume (6896) is from bundled dependencies. No tool poisoning with hidden directives, no credential theft architecture, no suspicious network destinations. The package should be treated as likely_false_positive.

Key Reasons

• Tool-poisoning findings are false positives from legitimate MCP tool definitions in SDK library
• No credential-access findings targeting sensitive paths (.ssh, .aws, .kube)
• Network calls are to expected services (OpenRouter, embedding services) from bundled dist/ files
• 6896 total findings dominated by bundled dependency noise (3614 IoC, 2588 malware-signature)
• No exfiltration architecture: no combination of secret reads + unknown domain calls

False Positive Considerations

• Tool definitions in SDK code flagged as tool-poisoning
• Bundled dependencies in dist/ directory generating IoC and malware-signature findings
• IoC extractor noise (SHA256 hashes without domain context)
• Code-smell YARA rules matching basic Node.js patterns

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 75%.