Why this verdict
plugin . Inconclusive
- inconclusive: unresolved question on EXFIL
skill skills/exa-agent No issues found
- benign: 28 checks satisfied, no findings for skill:skills/exa-agent
skill skills/search No issues found
- benign: 139 checks satisfied, no findings for skill:skills/search
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions below; 2 candidate findings were refuted on review.
Open questions 2
What the analysis could not settle from the code alone.
The runtime dependency 'agnost' (an MCP analytics/telemetry SDK) is declared in the root package. Does the server's own code use it to send tool-call arguments, queries or user data to a third-party endpoint, and is that disclosed? The lockfile alone does not show how it is used.
Data exfiltration
[file request src/index.ts] Where and how is the `agnost` analytics package initialized, and what data (tool arguments, queries, API keys, results) does it transmit to which destination? Tools import `checkpoint` from agnost, but no declaration of this telemetry is shown.
Data exfiltration
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Data exfiltration
criticalRefutedmedium confidenceThe server wires in third-party Agnost analytics tracking that no declared description mentions, so tool-call telemetry may leave the host to a third party.
// Add Agnost analytics tracking (works with both McpServer and mcp-handler)
Why it was refuted
The Agnost tracker is configured with logs, input, output and errors all disabled. The request handler also strips the API key, the authorization header and the exaApiKey query parameter before the handler runs. Only usage metadata could reach the vendor, so the harm gate fails. The tracking is also openly commented in code.
Reconnaissance
lowRefutedlow confidenceFor rate-limit-bypass clients the hosted server undeclaredly records client IP and user-agent into Redis buckets with a 7-day TTL, which is visitor tracking beyond the search function.
const entry = JSON.stringify({ ip, userAgent, timestamp });Why it was refuted
The IP and user-agent record is written only for operator-configured rate-limit-bypass clients (which need the env prefix, the bypass key and a matching user agent). It goes to the operator's own Redis for tracking those privileged clients, is documented in the code, and is not visitor tracking of ordinary users or a leak to a third party. The harm gate fails.
