Is @ai-sdk/mcp safe?

No malicious indicators - review capabilities before installing

Notable — review in context (capabilities are not malware):

Node.js shell/command execution
Delegated authentication (OAuth 2.0 / OIDC)

@ai-sdk/mcp is an AI npm_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 2 risky constructs are reported for review. It can: delegated authentication and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).

@ai-sdk/mcp 2.0.62

npm_package · npm:@ai-sdk/mcp

LOW

/ 100 risk score

Snapshot · scanned Sep 28, 2026 · @ai-sdk/mcp@2.0.62 · engine 0.53.0 / ruleset 60

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of @ai-sdk/mcp's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):

delegated authenticationshell execution

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Execution authority

Tool Access Control / Direct Tool Access

Delegated authentication

Tool Execution Context / User Delegated Credentials

Findings (2)

HIGHNode.js shell/command executionST-SHELL-NODE

The component can run operating-system commands or spawn processes.

dist/mcp-stdio/index.d.ts:1-1

import { IOType } from 'node:child_process';

dist/mcp-stdio/index.js:352-352

import spawn from "cross-spawn";

src/tool/mcp-stdio/create-child-process.ts:1-1

import type { ChildProcess } from 'node:child_process';

src/tool/mcp-stdio/create-child-process.ts:2-2

import spawn from 'cross-spawn';

src/tool/mcp-stdio/create-child-process.ts:19-19

return spawn(config.command, config.args ?? [], {

src/tool/mcp-stdio/mcp-stdio-transport.ts:1-1

import type { ChildProcess, IOType } from 'node:child_process';

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

LOWDelegated authentication (OAuth 2.0 / OIDC)ST-AUTH-DELEGATED

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (17 occurrence(s) shown as evidence).

dist/index.d.ts:78-78

id_token: z.ZodOptional<z.ZodString>;

dist/index.d.ts:89-89

authorization_endpoint: z.ZodString;

dist/index.d.ts:108-108

authorization_endpoint: z.ZodString;

dist/index.js:404-404

id_token: z3.string().optional(),

dist/index.js:432-432

authorization_endpoint: SafeUrlSchema,

dist/index.js:446-446

authorization_endpoint: SafeUrlSchema,

dist/index.js:870-870

url: new URL("/.well-known/openid-configuration", url.origin),

dist/index.js:895-895

url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),

dist/index.js:900-900

url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),

dist/index.js:969-969

authorizationUrl = new URL(metadata.authorization_endpoint);

src/tool/oauth-types.ts:37-37

id_token: z.string().optional(), // Optional for OAuth 2.1, but necessary in OpenID Connect

src/tool/oauth-types.ts:67-67

authorization_endpoint: SafeUrlSchema,

src/tool/oauth-types.ts:88-88

authorization_endpoint: SafeUrlSchema,

src/tool/oauth.ts:619-619

url: new URL('/.well-known/openid-configuration', url.origin),

src/tool/oauth.ts:649-649

url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),

src/tool/oauth.ts:655-655

url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),

src/tool/oauth.ts:766-766

authorizationUrl = new URL(metadata.authorization_endpoint);

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →