@iflow-mcp/ahrefs-mcp-server

AI Security Review

Evidence context: threat category none; evidence quality moderate.

@iflow-mcp/ahrefs-mcp-server version 0.0.11 describes itself as an MCP server for Ahrefs, the SEO data platform. The scan behind this review returned 21 findings, and almost all of them are the ordinary debris of scanning a bundled JavaScript file.

Take the defining MCP threat first. The scan matched zero tool-poisoning patterns. There are no hidden instructions in tool descriptions, no invisible Unicode carrying directives, no XML tags like aimed at an AI agent, and nothing telling the model to act quietly or exfiltrate through another tool. For a package in this category, that absence is the single most useful thing in the file.

The only network finding is NET-AXIOS-build/server.js-5338, an axios HTTP call located at build/server.js:5338. Axios is an ordinary HTTP client, and this package is a wrapper that has to talk to Ahrefs. The destinations on record back that up: api.ahrefs.com and app.ahrefs.com are the vendor's API and dashboard, while docs.ahrefs.com, modelcontextprotocol.io and docs.cursor.com are documentation sites. Nothing in that list looks like a collection point for stolen data.

Credential access is where this package stays quiet. There are no secret findings and no references to .ssh keys, .aws/credentials, .kube/config or application_default_credentials.json. An Ahrefs server needs an Ahrefs API token to work, but even a token read is absent from the findings. The exfiltration pattern we hunt for is a credential read combined with a call to an unfamiliar domain. Here only the network half exists, and it points at Ahrefs.

The rest is scanner noise. Twelve code-smell hits and eight indicator entries across a bundled build/server.js are exactly what minified or bundled output produces. The indicator extractor turns hex fragments and property chains into fake domains, so the count says nothing about intent. The network entry itself is medium severity and low specificity.

The strongest counterargument is the publisher. This ships under the @iflow-mcp namespace from chatflowdev, not from Ahrefs, which makes it a repackaging of someone else's MCP server. Republished MCP servers are a documented supply-chain vector, and an aggregator publisher deserves more scrutiny than a first-party one. That concern is real, and it is why this is not a permanent clearance for every future release. It does not change what version 0.0.11 does. A malicious republish would show up as credential reads, hidden tool instructions, or traffic to an unknown host. None of the three is here.

Two endpoints, param.in and terminal.app, don't belong to Ahrefs. Neither appears in code that sends data; they read as documentation text. Worth a second look, not a verdict.

Key Reasons

• Zero tool-poisoning matches: no hidden AI directives, invisible Unicode or instruction tags in tool descriptions.
• No credential or secret findings; nothing touches .ssh, .aws/credentials, .kube/config or application_default_credentials.json.
• Only network finding is NET-AXIOS-build/server.js-5338, a bundled axios HTTP client at build/server.js:5338, and all endpoints are Ahrefs' documented API and documentation sites.
• Twelve code-smell hits and eight indicator entries are bundled-JavaScript scanner noise with no behavioral meaning.
• Publisher is the @iflow-mcp repackaging namespace rather than Ahrefs itself, which warrants monitoring future versions but shows no malicious code in 0.0.11.

False Positive Considerations

• IoC extractor noise from bundled build/server.js output
• YARA code-smell rules firing on minified JavaScript
• Legitimate Ahrefs API client code matching generic network rules
• Documentation URLs (param.in, terminal.app) stripped of context by the endpoint extractor

Reviewed 2026-10-03; recommended action: no action; model confidence 77%.