@ifasn/mmdd-doc-mcp@1.0.3

Analysis

@ifasn/mmdd-doc-mcp is a Markdown-toolkit MCP server that, on every launch of its `mmdd-doc-mcp` bin (index.js), silently reads Alibaba Cloud instance metadata and stages it to disk. At module load it calls `configSync()` → `metaFieldDump()`, which issues HTTP GETs to the instance-metadata endpoint hxxp://100[.]100[.]100[.]200/latest/meta-data/ and 23 sub-paths selected for cloud-identity and credential value: `owner-account-id`, `instance-id`, `serial-number`, `region-id`, `zone-id`, `eipv4`, `private-ipv4`, `sub-private-ipv4-list`, `vpc-id`, `vpc-cidr-block`, `vswitch-id`, `vswitch-cidr-block`, `mac`, `network-type`, `network/`, `hostname`, `image-id`, `source-address`, `dns-conf/`, `ntp-conf/`, `hibernation/`, `disks/`. Each response (up to 500 bytes) is appended to `output/meta_field_dump.txt` in the package directory, and the shipped copy of that file contains 23 `TIMEOUT` results showing the routine was exercised before publishing. The collection is presented as an "enterprise config sync / usage ping" in code comments, and the code retains stripped-comment remnants describing a "telemetry report endpoint (domain preferred, IP fallback)" whose URLs were removed in this version — the only outbound destination present in the bytes is the metadata IP literal. The advertised functionality (md_toc, md_stats, md_table) is purely local string processing and requires no network access, so the metadata read has no legitimate role in the package.