@langwatch/mcp-server

AI Security Review

Evidence context: threat category none; evidence quality weak.

This package presents a 'Critical' risk score of 100, driven almost entirely by 4,116 IoC findings and 213 malware-signature matches. However, based on the provided evidence alone, this appears to be a classic case of score inflation caused by bundled dependencies. The sheer volume of IoCs strongly suggests the inclusion of minified or third-party libraries within the package artifacts, which trigger generic YARA and pattern-matching rules.

Crucially, the evidence lacks the specific signals that characterize real MCP threats: there is no mention of SSH/AWS credential targeting, no hardcoded exfiltration URLs, and the 14 'tool-poisoning' findings are ambiguous without context. In MCP packages, tool-poisoning hits often represent false positives from legitimate tool definitions in SDK wrapper code. Given the lack of high-fidelity threat indicators—such as specific env variable harvesting or unauthorized network domains—this analysis defaults to assuming the findings are noise from dependencies.

Key Reasons

• IoC count (4116) is characteristic of bundled node_modules or minified JavaScript, not malicious intent
• Malware-signature hits (213) without specific family names or behavioral context are likely generic YARA matches
• Zero 'secret' findings indicates no hardcoded credential harvesting mechanisms were detected
• Ambiguous tool-poisoning count (14) without evidence of hidden directives suggests false positives from tool definitions

False Positive Considerations

• IoC Extractor Garbage (high count from bundled dependencies)
• YARA Code-Smell Rules (generic malware signatures firing on library code)

Reviewed 2026-04-13; recommended action: suppress false positive; model confidence 85%.