kdocs

No clear indicators of overt malicious behavior (no obvious backdoor, obfuscation, or unexpected destinations beyond the configured MCP_URL). However, the script has moderate security risk due to (1) runtime auto-installation of an unpinned npm package (mcporter) and (2) direct execution of a local get-token.sh script whose contents are not shown, both of which are high-impact execution sinks. It also writes bearer tokens into persistent mcporter configuration and uses --transport http despite an https URL, which could increase token-in-transit exposure depending on mcporter’s transport behavior. Recommend pinning mcporter versions, verifying integrity, reviewing get-token.sh, and confirming mcporter transport behavior ensures TLS for token-bearing requests.