Is telodocs safe to use?

telodocs has a security risk score of 74.71/100 (HIGH risk). Our security analysis detected 393 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of telodocs?

Based on our automated security analysis, telodocs presents high risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

MCP Registry

telodocs

Name: telodocs
Availability: InStock
Author: GitHub Actions

by GitHub Actions

fe78aa4b-e5eb-5db3-bdc3-b1df52329f5c | v0.4.8

Open marketplace

HIGH risk

Risk verdict

Review before use

Score-based assessment (high risk, 75/100). No analyst review available.

Analysis record

Analysed: 3 weeks ago
Version: v0.4.8
Artifact: SHA256 8ED…C23
Source: Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

109 detail rows

YARA Rule Matches

14 rules

Severity	Rule	Hits	Files	Metadata
LOW	`postinstall file download`	5	dist/server/mcp/mcp.service.d.tsdist/server/mcp/mcp.service.jsdist/server/docs-render/docs-spa.service.js +2 more	-
LOW	`NoUseWeakRandom`	2	dist/web/assets/index-156FMirI.js.mapdist/web/assets/index-156FMirI.js	-
LOW	`LocalStorageShouldNotBeUsed`	2	dist/web/assets/index-156FMirI.js.mapdist/web/assets/index-156FMirI.js	-
LOW	`postinstall crypto operations`	3	dist/server/auth/auth.service.jsdist/web/assets/index-156FMirI.jsdist/web/assets/index-156FMirI.js.map	-
LOW	`NoRenderContentFromRequest`	1	dist/server/docs-render/docs-render.controller.js	-
LOW	`postinstall file manipulation`	14	dist/server/search/search.service.jsdist/server/app.module.jsdist/web/assets/index-156FMirI.js +11 more	-
LOW	`postinstall environment access`	27	dist/server/core/config/env.validation.d.tsdist/server/mcp/mcp-nav.util.d.tsdist/server/docs-render/docs-nav.service.d.ts +24 more	-
LOW	`postinstall network communication`	13	dist/web/assets/index-156FMirI.js.mapdist/server/mcp/mcp-instructions.d.tsdist/web/assets/index-156FMirI.js +10 more	-
LOW	`postinstall registry modification`	3	dist/server/mcp/mcp-tool-registry.jsdist/server/mcp/mcp-tool-registry.js.mapdist/server/mcp/mcp.service.js	-
LOW	`postinstall obfuscation`	3	dist/web/assets/index-156FMirI.js.mapdist/web/assets/index-156FMirI.jsdist/server/docs-render/utils/doc-path.util.js	-
LOW	`postinstall system command`	15	dist/server/mcp/mcp-instructions.d.tsdist/web/assets/index-156FMirI.js.mapdist/cli/commands/serve.js +12 more	-
LOW	`RedirectToUnknownPath`	2	dist/web/assets/index-156FMirI.js.mapdist/server/auth/auth.controller.js	-
LOW	`credential env files`	14	dist/server/search/search.service.jsdist/cli/commands/serve.jsdist/server/core/config/env.validation.js +11 more	-
LOW	`postinstall persistence mechanism`	1	dist/web/assets/index-156FMirI.js.map	-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

284 total

...

Network indicators are queued for lazy loading

Scroll this section into view to load the detailed rows.

Finding Categories

Secrets

Network

284

IoC Indicators

YARA Rules Matched

14 rules(105 hits)

postinstall file download NoUseWeakRandom LocalStorageShouldNotBeUsed postinstall crypto operations NoRenderContentFromRequest postinstall file manipulation postinstall environment access postinstall network communication postinstall registry modification postinstall obfuscation postinstall system command RedirectToUnknownPath credential env files postinstall persistence mechanism

MCP Server Analysis

MCP servers expose tools and resources to AI assistants. Unlike browser extensions, they run as standalone processes with direct system access. Tool definitions are analyzed for prompt injection, data exfiltration, and tool poisoning patterns.

Security Analysis Summary

Security Analysis Overview

telodocs is a MCP Servers extension published by GitHub Actions. Version 0.4.8 has been analyzed by the Risky Plugins security platform, receiving a risk score of 74.71/100 (HIGH risk) based on 393 security findings.

Risk Assessment

This extension presents high security risk. Significant concerns were identified during analysis. It is not recommended for use in sensitive or production environments without thorough review.

Findings Breakdown

Critical: 1 finding(s)
High: 2 finding(s)
Medium: 285 finding(s)
Low: 105 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

telodocs is published by GitHub Actions on the MCP Servers marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

About This Extension

Documentation MCP server and docs site — content in docs/, telodocs runs the rest