@kya-os/mcp-i

AI Security Review

Evidence context: threat category none; evidence quality moderate.

@kya-os/mcp-i is a TypeScript MCP framework at version 1.13.1, published by h0bb5. It builds MCP servers and ships the pieces those servers need: stdio and HTTP transports, Express and Next.js adapters, OAuth proxy support, a Cloudflare KV cache backend and a delegation verifier. The package declares no permissions and no static network endpoints, which is what a library that runs inside the developer's own server looks like.

Tool poisoning is the first thing to check, and all four critical findings come from that rule: MCP-TOOL-TOOL-POISONING-dist/runtime/stdio.js-7, the same title at dist/runtime/http.js-8, dist/runtime/adapter-express.js-8 and dist/runtime/adapter-nextjs.js-8. Those four files are the transport entry points, the exact places where a framework registers tool names and description strings so a developer's tools become visible to an agent. The rule matches the shape of a tool definition, an object with a description field aimed at a model, and it cannot tell whether the string was written by the framework author or injected over someone else's tool. The flagged paths contain no hidden directives, no instruction tags, no 'do not tell the user' text and no invisible Unicode (the obfuscation category is empty). These are tool definitions, the documented false-positive pattern for SDKs.

On credentials, the package reads nothing sensitive. There are no credential-access findings at all, so no code path touches ~/.ssh, ~/.aws/credentials, ~/.kube/config or application_default_credentials.json, and there are no secret findings. Configuration env reads are the framework's business and the scanner did not flag any.

Network access is real but ordinary. The sixteen NET-FETCH hits all sit under dist/: dist/auth/oauth/providers/proxy-provider.js:54, :102 and :128, dist/auth/oauth/router.js:218, dist/cache/cloudflare-kv.js:20, dist/providers/node-providers.js:173, dist/runtime/delegation-verifier-checkpoint.js:137, :174 and :199, dist/runtime/proof-batch-queue.js:85 and :151, and dist/runtime/stdio.js:1 and :4. Read by filename, they map one-to-one onto features the package advertises: OAuth provider proxying, an OAuth router, a Cloudflare KV cache, an HTTP provider, checkpoint verification for delegation and batch proof submission. None of them is paired with a credential read, which is the combination that would signal exfiltration. The IoC list is empty, so no unknown domain is hiding in the bundle.

The strongest argument against this reading is the publisher. h0bb5 is not a known vendor, the package has no users yet, and MCP tooling gets less vetting than browser extensions, so an unfamiliar framework with this much history is worth watching. That argument concerns trust in the author, not anything in this artifact: zero malware signatures, zero obfuscation, zero credential access, zero suspicious domains. A future release could change that, and diffing 1.14.0 against this build is the cheap way to catch it.

Key Reasons

• All four critical tool-poisoning hits are in dist/runtime transport entry points (stdio.js:7, http.js:8, adapter-express.js:8, adapter-nextjs.js:8), the places a framework registers tool definitions
• No credential-access findings, no secret findings, and no reads of ~/.ssh, ~/.aws/credentials or ~/.kube/config anywhere in the package
• All sixteen NET-FETCH hits sit in dist/ and match advertised features: proxy-provider.js, oauth/router.js, cloudflare-kv.js, node-providers.js, delegation-verifier-checkpoint.js, proof-batch-queue.js
• Zero IoC, zero malware signatures, zero obfuscation findings
• Publisher is unknown with no user base, so version history is the only remaining risk surface

False Positive Considerations

• Tool-poisoning rule matching legitimate tool definition strings in SDK transport adapters
• Bundled/dist output inflating general finding counts
• Framework networking (OAuth proxy, Cloudflare KV cache) flagged as generic NET-FETCH

Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 75%.