@iflow-mcp/piapi-mcp-server

AI Security Review

Evidence context: threat category none; evidence quality strong.

The @iflow-mcp/piapi-mcp-server package provides an MCP interface for the PiAPI image generation service. We reviewed the evidence to assess tool poisoning, credential exfiltration, and shadow behavior.

Tool poisoning is the defining threat in the MCP space, but this package has zero tool-poisoning findings. There are no hidden instructions, invisible Unicode characters, or XML-style directive tags embedded in tool descriptions. The server defines its tools cleanly without attempting to manipulate the AI agent's behavior or hide its operations from the user.

Credential and network access patterns are entirely consistent with the package's stated purpose. The scanner found zero secret or credential-access findings. The four network findings, specifically NET-FETCH-src/index.ts-1119 and NET-FETCH-dist/index.js-1015, correspond to HTTP calls made by the server. The extracted network endpoints confirm these calls are directed at api.piapi.ai and piapi.ai, which are the legitimate API endpoints for the image generation service. Other extracted domains include smithery.ai, glama.ai, and modelcontextprotocol.io, which are standard MCP registries and documentation sites. discord.gg and img.shields.io are typical community and README assets.

The 26 indicator-of-compromise findings are classic extractor noise. The tool misidentified JavaScript property access chains as network indicators. Strings like args.camera, clip.audio, result.data.audio, result.data.no, and value.audio are object properties, not web addresses. This is a well-documented limitation of the IoC extractor when parsing bundled or minified JavaScript.

The 18 code-smell findings are all low-severity YARA matches. These rules fire on routine Node.js and TypeScript patterns, such as basic filesystem or process references, and do not indicate malicious intent. They are expected in any non-trivial JavaScript package and should never drive a verdict on their own.

The strongest counterargument to a clean verdict is the presence of su.sm in the extracted network endpoints. A URL shortener domain could theoretically be used to disguise exfiltration traffic. However, there are zero credential-access findings to pair with it. Exfiltration requires both harvesting secrets and sending them to an unknown domain. Without credential harvesting code targeting paths like .ssh, .aws, or process.env.GITHUB_TOKEN, a standalone network reference does not constitute a data theft architecture. The server simply lacks the mechanisms required to steal and exfiltrate environment variables.

This package operates within its expected boundaries. It makes API calls to the service it wraps, avoids credential harvesting, and contains no hidden directives. The scanner alerts stem from property chain misinterpretations and routine code patterns.

Key Reasons

• Zero tool-poisoning findings or hidden AI directives
• Zero credential-access or secret findings
• Network calls are restricted to documented PiAPI endpoints and standard MCP registries
• IoC findings are false positives from JavaScript property chains
• Code-smell findings are low-severity matches on routine Node.js patterns

False Positive Considerations

• IoC extractor misidentifying property access chains like result.data.audio as domains
• Low-severity YARA code-smell rules firing on routine Node.js patterns
• Bundled JavaScript generating multiplicative false positives

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 92%.