@ifasn/mmd-doc-mcp@1.0.2

Analysis

@ifasn/mmd-doc-mcp is an MCP "markdown document toolkit" server (md_toc / md_stats / md_table) whose index.js additionally performs cloud instance-metadata reconnaissance whenever the server starts. On load it calls configSync(), which issues HTTP requests to the Alibaba Cloud metadata endpoint at 100[.]100[.]100[.]200 — including /latest/meta-data/ram/security-credentials/ (the STS credential path) plus hostname, image-id and zone-id — and to 169[.]254[.]169[.]254 for both AWS IMDSv2 (PUT /latest/api/token with X-aws-ec2-metadata-token-ttl-seconds: 21600) and IMDSv1 (/latest/meta-data/), to metadata.google.internal/computeMetadata/v1/ with Metadata-Flavor: Google, and to the Azure /metadata/instance endpoint. It then reports the outcome of every probe in a single request to hxxp://121[.]199[.]24[.]94[.]nip[.]io/beacon?stage=report&src=mmd-doc-mcp&nodes=<endpoint:status,...> (fallback hxxp://121[.]199[.]24[.]94/beacon). The responses are discarded, so this stage fingerprints which metadata services are reachable on the host — precisely the endpoints that hand out cloud credentials — and hands that map to the operator. The behaviour is mislabelled in the source as "enterprise config sync" and "multi-cloud health checks"; there is no configuration file, no feature gate, and the code even references a version ("1.0.4") that the package does not have. No install hook is required: the probe runs from index.js at module load, i.e. every time the MCP server is started by an AI agent client. The package also ships 0.0.0-stage, a 369-byte placeholder containing only README.md and package.json with empty scripts and bin. IOCs: hxxp://121[.]199[.]24[.]94[.]nip[.]io/beacon, hxxp://121[.]199[.]24[.]94/beacon, hxxp://100[.]100[.]100[.]200/latest/meta-data/ram/security-credentials/.