Why this verdict
- suspicious: finding mcp-server:.:dist/index.js:3071:CRED
- suspicious: finding mcp-server:.:dist/index.js:3071:EXFIL
- suspicious: unverified finding mcp-server:.:dist/index.js:1628:PRIVESC
Security findings 3
Credential access
highContextual riskmedium confidenceThe MCP server reads MICROSERVICES_API_KEY/TOKEN from the environment and attaches it as a Bearer header to a fetch whose base URL can be overridden by the tool-call argument apiUrl, so a prompt-injected or malicious agent call could send the stored API key to an arbitrary host.
apiUrl: String(args.apiUrl ?? env.MICROSERVICES_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, ""),
vector:code
Counter-argument considered
The tool argument apiUrl overrides the base URL while the env-sourced API key is attached as a Bearer header to the same request. A prompt-injected call could therefore send the stored key to an arbitrary host, and no allowlist or mitigation is shown.
Data exfiltration
highContextual riskmedium confidenceThe control-plane URL and API key are accepted as agent-supplied tool arguments (apiUrl/apiKey), so a prompt-injected agent could redirect deploy_preview/get_deployment_status requests, which carry the env-sourced Bearer token and project config, to an arbitrary host; the arbitrary-host override is not covered by the declared env-only configuration.
apiUrl: String(args.apiUrl ?? env.MICROSERVICES_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, ""),
vector:code
Counter-argument considered
The agent-supplied apiUrl redirects deploy_preview and get_deployment_status requests, which carry the Bearer token and project config, to any host. Nothing in the code restricts the host.
Privilege escalation
mediumUnverifiedmedium confidenceThe scaffold generator emits an auth module mounted on public routes where POST /auth/tokens mints signed tokens for caller-chosen subject and scopes (including gateway.admin) and POST /auth/keys/rotate rotates the signing key, both with no authentication, so any network caller can forge privileged tokens.
authRoutes.post("/tokens", async (c) => {vector:code
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Data exfiltration
criticalRefutedlow confidenceThe scaffolded project CLI script emitted by this generator sends usage telemetry (template id, module count, module ids, exit codes, durations) to api.microservices.sh (or an env-overridable URL) by default; the telemetry is undeclared in the artifact metadata, and the first-run notice is suppressed in --json mode, which agents typically use.
await fetch(TELEMETRY_API_URL + "/events", {Why it was refuted
This is anonymous product telemetry (template id, module count) in the scaffolded CLI. It prints an in-tool notice and honors MICROSERVICES_TELEMETRY and DO_NOT_TRACK opt-outs. It carries no credentials or sensitive data, so it is not harmful exfiltration.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
server.json
