Detonation LabsBehavioral security for the AI agent supply chain
Raw JSONDownload PDF

Verdict

Could not run: not tested

We could not start this server, so none of its behavior was tested.

1 finding. Scanned 25 Oct 2026 by detonator 0.5.1.

Target
@faapi/mcp
Source
npm 7.6.0
SHA-256
9fcc42c32cfc440c
Files
7
RecommendationReview

We could not start it, so nothing was tested. Treat it as unverified.

What this package does

observed across 3 runs
  1. Package @faapi/mcp version 7.6.0 · 7 files · MCP server
  2. Install No install scripts of its ownOnly the package manager ran.
  3. Runs as node ./dist/index.js
  4. What it reached
    Network

    No connections.

    Credentials

    None of the planted fake keys were touched.

    ~/.npmrc read by its own tool (normal)

    Files written

    Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

A tool read its own credentials (e.g. gh, aws, ssh)

Confidence
Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
Observed in
mcp:baseline

Description

A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.

Impact

None in itself: this is how those tools work. Listed so the report shows every credential access.

Evidence

~/.npmrc (by npm)

Remediation

No action needed.

Process tree

run mcp:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree
  • runbash -c export npm_config_update_notifier=false npm_config_audit=...
    • runnpm rebuild --offline --foreground-scripts --no-audit --no-fund
      • runnode /usr/bin/npm rebuild --offline --foreground-scripts --no-audit
        • secretread ~/.npmrc (its own config)
  • runbash -c node skill/node_modules/@faapi/mcp/./dist/index.js
    • runnode skill/node_modules/@faapi/mcp/./dist/index.js

Exploration log

3 runs
  1. mcp:baseline ok · 2.1s

    new behavior: ownread:~/.npmrc, write:~/.npm/_logs/*-debug-0.log · server did not complete the handshake: no response; 0 tool calls

  2. mcp:time-travel ok · 2.0s

    no new behavior · server did not complete the handshake: no response; 0 tool calls

  3. mcp:ci-github ok · 2.0s

    no new behavior · server did not complete the handshake: no response; 0 tool calls

mcp: coverage plateau (2 runs with no new behavior)

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.