Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/dist/auth/TokenValidator.d.ts b/dist/auth/TokenValidator.d.ts
--- a/dist/auth/TokenValidator.d.ts
+++ b/dist/auth/TokenValidator.d.ts
@@ -19,1 +19,0 @@
-* Configuration for proxy token validation.
@@ -20,1 +19,0 @@
-* Set via setProxyTokenConfig() when OAuth proxy JWT signing is enabled.
@@ -22,1 +20,0 @@
-interface ProxyTokenConfig {
@@ -28,1 +25,0 @@
-* Configures the proxy token validation settings.
@@ -31,1 +27,0 @@
-* @param config - Proxy token configuration
diff --git a/dist/auth/JWTIssuer.d.ts b/dist/auth/JWTIssuer.d.ts
--- a/dist/auth/JWTIssuer.d.ts
+++ b/dist/auth/JWTIssuer.d.ts
@@ -35,1 +35,0 @@
-* Creates a JWT Issuer for signing proxy tokens.
@@ -61,1 +60,0 @@
-isProxyToken: (token: string) => boolean;
diff --git a/dist/auth/JWTIssuer.js b/dist/auth/JWTIssuer.js
--- a/dist/auth/JWTIssuer.js
+++ b/dist/auth/JWTIssuer.js
@@ -11,1 +11,0 @@
-* Creates a JWT Issuer for signing proxy tokens.
@@ -86,1 +85,0 @@
-function isProxyToken(token) {
@@ -98,1 +96,0 @@
-isProxyToken,
diff --git a/dist/Server.js b/dist/Server.js
--- a/dist/Server.js
+++ b/dist/Server.js
@@ -43,1 +43,0 @@
-import { hasAuthProviders, setProxyTokenConfig } from './auth/TokenValidator.js';
@@ -860,1 +859,0 @@
-setProxyTokenConfig({
diff --git a/dist/auth/TokenValidator.js b/dist/auth/TokenValidator.js
--- a/dist/auth/TokenValidator.js
+++ b/dist/auth/TokenValidator.js
@@ -19,1 +19,0 @@
-let proxyTokenConfig;
@@ -21,1 +20,0 @@
-* Configures the proxy token validation settings.
@@ -24,1 +22,0 @@
-* @param config - Proxy token configuration
@@ -26,1 +23,0 @@
-export function setProxyTokenConfig(config) {
@@ -27,1 +23,0 @@
-proxyTokenConfig = config;
diff --git a/dist/auth/types.d.ts b/dist/auth/types.d.ts
--- a/dist/auth/types.d.ts
+++ b/dist/auth/types.d.ts
@@ -211,1 +211,0 @@
-/** Issuer - always "urn:mj:mcp-server" for proxy tokens */
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -146,1 +146,0 @@
-| `Run_<Prompt>_Prompt` | Execute a configured AI prompt with template data |

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 6.1.7. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: ai-mcp-server: Credential pass-through configuration (KillerSkills verdict caution 77)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 77/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/npm/ai-mcp-server/6.1.7

## Findings with a location
- `dist/auth/TokenValidator.d.ts:28` · Credential pass-through configuration — dist/auth/TokenValidator.d.ts:28 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/JWTIssuer.d.ts:35` · Credential pass-through configuration — dist/auth/JWTIssuer.d.ts:35 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/JWTIssuer.d.ts:61` · Credential pass-through configuration — dist/auth/JWTIssuer.d.ts:61 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/JWTIssuer.js:98` · Credential pass-through configuration — dist/auth/JWTIssuer.js:98 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/Server.js:43` · Credential pass-through configuration — dist/Server.js:43 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/TokenValidator.js:27` · Credential pass-through configuration — dist/auth/TokenValidator.js:27 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/TokenValidator.d.ts:19` · Credential pass-through configuration — dist/auth/TokenValidator.d.ts:19 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/TokenValidator.d.ts:22` · Credential pass-through configuration — dist/auth/TokenValidator.d.ts:22 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/TokenValidator.d.ts:31` · Credential pass-through configuration — dist/auth/TokenValidator.d.ts:31 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/JWTIssuer.js:86` · Credential pass-through configuration — dist/auth/JWTIssuer.js:86 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/auth/TokenValidator.js:19` · Credential pass-through configuration — dist/auth/TokenValidator.js:19 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/Server.js:860` · Credential pass-through configuration — dist/Server.js:860 · Credential pass-through configuration — agent relays sensitive credentials

## Proposed change
The attached patch removes the 19 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._