Notes 5
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
mediumNoteConfirmed on reviewlow confidenceThe hosted OAuth token endpoint issues the user's actual API key as the access token, so the key itself is handed to the MCP client; this is the publisher's own service and a design exposure rather than theft.
Issue the access token (the user's actual API key)
vector:code
Reviewer's reasoning
The token endpoint returns the Scavio API key to the OAuth client the user authorized through the publisher's own consent flow, so the key goes to a client the user chose and the publisher's own service issued it. This is a design exposure, not a credential sent to an unmentioned host.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe OAuth token endpoint hands the user's raw Scavio API key to the registered OAuth client as access_token after consent, which is the publisher's own designed flow for its own service key.
access_token: codeData.apiKey,
vector:code
Reviewer's reasoning
The token response carries the user's own Scavio key to the consented client after PKCE verification, which is the publisher's declared OAuth design for its own service key.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe HTTP MCP endpoint accepts the user's Scavio API key from the api_key URL query parameter, so the key appears in request URLs, logs, and proxies; a hygiene weakness in the publisher's own service, not a hidden channel.
c.req.query("api_key");vector:code
Reviewer's reasoning
Accepting the API key from a query parameter is a hygiene weakness in the publisher's own endpoint that exposes the key in URLs and logs. It is not a hidden channel and does not act against the user on its own.
Reconnaissance
infoNoteConfirmed on reviewlow confidenceThe auth store fetches client metadata from any URL supplied as client_id, a server-side request to a caller-chosen address (SSRF-type exposure, a bug the publisher should fix); it is not hidden and not directed at the installer.
CIMD: if client_id is a URL, fetch metadata from it
vector:code
Reviewer's reasoning
Fetching metadata from a caller-supplied client_id URL is a server-side request that needs an outside caller to trigger it. The artifact only makes it possible, so it is a vulnerability, not an overreach or abuse.
Reconnaissance
infoNoteConfirmed on reviewlow confidenceThe client store fetches arbitrary https URLs supplied as client_id (CIMD), so any caller can make the server request attacker-chosen hosts, an unconfirmed server-side request risk.
if (clientId.startsWith("https://")) {vector:code
Reviewer's reasoning
The same caller-driven metadata fetch for https client_id values needs an external client to supply the URL, so it is a vulnerability that the artifact enables, not an overreach.
