zipline-mcp

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The single tool-poisoning finding, MCP-TOOL-TOOL-POISONING-dist/index.js-458, sits in the main entry point where MCP tools are defined. This package registers tools for uploading files to Zipline-compatible hosts, and tool definitions naturally include description fields that the scanner matches against. One finding of this type in a package that defines file-upload tools is consistent with the scanner flagging a tool description, not a hidden instruction aimed at the AI agent. No additional tool-poisoning patterns were found across the remaining 180 findings.

The nine secret findings all carry the title MCP-TRANSPORT-HARDCODED-TOKEN and every one of them lives in a .test.js file: dist/userFiles.test.js, dist/sandboxUtils.test.js, dist/index.test.js, and dist/httpClient.test.js. Test files routinely contain hardcoded tokens so that unit tests can run without external configuration. The MCP transport scanner flags these as critical, but they are test fixtures, not production credentials embedded in shipped code.

Network access is expected here. The package uploads files to Zipline hosts, and the NET-FETCH findings in dist/userFiles.js, dist/remoteFolders.js, and dist/index.js reflect that functionality. The network endpoints extracted from the bundle include zipline.diced.sh, which is a known public Zipline instance, along with etereo.one, file.xyz, and single.in which look like example hostnames or test URLs. The strings archive.zip and user1-notes.md are example filenames, not network destinations. No credential-access findings target sensitive paths like .ssh, .aws/credentials, or .kube/config. There is no harvest-then-exfiltrate pattern connecting credential reads to calls to unknown domains.

The 109 code-smell findings are all low severity and match generic Node.js patterns in bundled dist/ files. The 42 IoC findings follow the same pattern: bundled dependencies in compiled output produce multiplicative false positives that the scanner counts individually.

The strongest counterargument is that the single tool-poisoning finding in dist/index.js:458 could contain a genuine hidden directive rather than a benign tool description. Without the source code in front of us, we cannot inspect that line directly. But a single match in a package whose entire purpose is defining upload tools, with no corroborating findings of exfiltration, credential theft, or suspicious network calls, does not establish malicious intent. The weight of evidence points to a legitimate file-upload MCP server whose bundled output and test files triggered the scanner's broad matching rules.

Key Reasons

• Single tool-poisoning finding is in tool definition code, consistent with scanner false positive on description fields
• All 9 hardcoded-token findings are in .test.js test fixture files
• Network calls target zipline.diced.sh, a known public Zipline instance matching the package's stated purpose
• No credential-access findings target sensitive paths like .ssh or .aws/credentials
• No harvest-then-exfiltrate pattern connecting any credential reads to unknown domain calls

False Positive Considerations

• MCP-TRANSPORT-HARDCODED-TOKEN findings in .test.js files are test fixtures, not production secrets
• MCP-TOOL-TOOL-POISONING match in tool definition code, not a hidden AI directive
• 109 code-smell findings from bundled dist/ dependencies
• 42 IoC extractions from compiled output with multiplicative false positives

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 78%.