Why this verdict
- benign: 48 checks satisfied, nothing works against the installer of mcp-server:. (3 notes, 0 third-party flags)
Security findings 0
No security findings
Nothing found that works against the person who installs it.
Notes 3
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Data exfiltration
mediumNoteConfirmed on reviewhigh confidenceverify_evidence_package POSTs the caller's evidence package to Dokimo's own A2A endpoint, as its docstring declares; a disclosed call to the publisher's service for the declared verification feature.
resp = _post_json(DOKIMO_A2A, payload)
vector:code
Reviewer's reasoning
The verify_evidence_package tool sends the caller's package to the publisher's own A2A endpoint, which its docstring discloses as the tool's declared verification purpose, so this is a note under the publisher's own service rule. The contradiction detector cites the claim on recompute_merkle_root, which is a separate tool and does make no network call.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceIn HTTP mode the hosted server logs each request's client IP and user agent to stdout for the publisher's own deployment; metadata only, arguments are not logged, and MCP_USAGE_LOG=0 disables it.
"ip": headers.get("cf-connecting-ip")vector:code
Reviewer's reasoning
The hosted server's _log_usage writes request metadata such as client IP and user agent to the publisher's own deployment stdout, which is operator telemetry under the publisher's own service rule rather than an action against the installer.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceThe DOKIMO_A2A_URL environment variable lets the operator redirect the verification endpoint; operator-controlled configuration, undeclared in the tool metadata but not hidden.
DOKIMO_A2A = os.environ.get("DOKIMO_A2A_URL", "https://dokimo.augaster.com/a2a")vector:code
Reviewer's reasoning
DOKIMO_A2A_URL is an operator-controlled environment override with a documented purpose (self-hosted deploys), so it is operator-controlled configuration and a note rather than a redirection of the user's tools.
