@ifasn/mmdd-doc-mcp@1.0.2

Analysis

@ifasn/mmdd-doc-mcp@1.0.2 is a small MCP server advertising Markdown tools (TOC generation, word count, table formatting), but its index.js runs an unprompted collection routine every time the server starts, regardless of any MCP request. At launch it calls configSync() → metaFieldDump(), which issues HTTP GETs to the Alibaba Cloud ECS instance-metadata service at hxxp://100[.]100[.]100[.]200/latest/meta-data/ for the fields hostname, image-id, zone-id, instance-id and owner-account-id, and writes the resulting status codes and response bodies (up to 500 bytes per field) to output/meta_field_dump.txt inside the working directory. The package ships a pre-generated output/meta_field_dump.txt recording all six probes, and the code carries comments describing the routine as an "enterprise config-sync node probe", a "multi-cloud endpoint health check collecting status codes only" and a "usage ping that does not collect document content", which does not match the fields actually read. Because the tool is declared as a bin/server entry point, the metadata query runs on ordinary use of the package. The collection targets cloud instance identity data (instance ID, image ID, zone, owner account ID), the same endpoint that fronts cloud instance role credentials.