Does @forestadmin/mcp-server send data, and where? — data-flow verdict

provisional · AUTOMATED — forensic confirmation pending. A preliminary, fact-based flag, not a judgment that the tool is unlawful or unsafe.

Verdict (the facts)

Tool

npm/@forestadmin/mcp-server

Integrity axis

honest — Observed behaviour matches the tool's stated function; the egress above is the tool doing its advertised job. 'honest' is the integrity axis — it does NOT imply the data flow is irrelevant; see the data-flow axis and jurisdiction.

Data-flow axis

Sends data to api.forestadmin.com (FR, jurisdiction tier 0) as its core function. No telemetry, analytics or error-reporting side-channel was found (full source + dependency-tree review). Where your data goes is determined by the tool's stated purpose, not by a hidden observability channel.

Disclosure

functional — NO telemetry/usage-analytics/error-reporting flow. All egress is functional/auth to a single first-party host, api.forestadmin.com (Forest Admin SAS, France/EU). The 2 captured launch requests, GET /liana/forest-schema (collection/field schema) and GET /liana/environment (OAuth init), both carry the configured Forest secret — functional setup for the admin-over-DB tool.

Capture self-test

verified

Severity

none — integrity axis only (undeclared exfiltration). Functional egress and disclosed metadata are reported as neutral facts and are not graded here.

Version (pinned)

1.12.3 · commit b31132cbccf27742a3d3bb94be3fa58cae77651f

Content hash

sha256:3eb20c7747b818740abd9a2e48be2868c5d18f140f3c0e71953636913d05bdfb

Signature

ed25519:ZLRY7WuvTxP0lnayIYV/CPwnwNnKOWIgU/dSGh… · Ed25519 public key · sha256:49cf8457b42a7048

Scanned

2026-06-14T00:00:00Z — Pinned to @forestadmin/mcp-server@1.12.3 (git b31132cbccf27742a3d3bb94be3fa58cae77651f), published 2026-06-11. This verdict applies to that exact version; a newer release would require a re-scan.

Re-verified

2026-06-14 — pinned version current

Categories

other functional-egress FR published

Observation history

1 scan(s); first seen 2026-06-14T00:00:00Z · latest 2026-06-14T00:00:00Z

Observed egress destinations

Each destination is classified FUNCTIONAL (the tool's advertised job requires the call — a neutral fact about where your data goes), SESSION/AUTH (handshake with the same operator), or TELEMETRY/ERROR_REPORTING (an observability side-channel not required for the function). Disclosure is judged across the tool's full public doc surface, not just its README, and any 'undisclosed telemetry' finding is adversarially refuted before it is asserted.

Jurisdiction context:

Evidence — the captured request (verify, don't just trust)

Capture self-test: verified — a beacon decoy was emitted from the tool's network context; its presence in the intercept means a 'no egress' result would have been trustworthy.

Observed: GET https://api.forestadmin.com/liana/forest-schema ×2 — intercepted (the tool's HTTPS was terminated against the sandbox CA; the egress was then blocked by strict-egress, but the full request was captured)

Payload fields actually sent:

Captured payload sample (one event):

Captured in the sandbox run. The distinct_id (a persistent machine identifier) and the write-only, public-by-design ingestion key are truncated above; payload_fields is the union observed across the run.

Reproduce it yourself (canary-sandbox (open methodology; Docker backend)):
python -m canary.cli scan <target> --backend docker # target: npm @forestadmin/mcp-server@1.12.3
Re-run it yourself: the scanner installs the pinned version, drives the tool over MCP, and intercepts all egress.

Full raw captured trace + verification: /verdict/forestadmin/evidence.json — every captured request (redacted), the verdict content-hash and the package checksum, for an AI or auditor that wants the underlying observation, not just the conclusion.

Disclosure check (the §824 evidence)

Read

package source (single first-party host); README + CHANGELOG; telemetry grep (none)

Quoted from the tool's own docs

“”

Match

NO telemetry/usage-analytics/error-reporting flow. All egress is functional/auth to a single first-party host, api.forestadmin.com (Forest Admin SAS, France/EU). The 2 captured launch requests, GET /liana/forest-schema (collection/field schema) and GET /liana/environment (OAuth init), both carry the configured Forest secret — functional setup for the admin-over-DB tool.

Residual gap

Forest Admin writes an activity-log/audit entry server-side (documented in CHANGELOG) — disclosed:partial, an inherent audit feature, not a third-party telemetry beacon. Jurisdiction: api.forestadmin.com is EU (France) — tier 0, no third-country transfer concern for EU data.

How we know this — claims by basis

A verdict is a reproducible evidence container, not just a claim. Each assertion is tagged: an observation is in the capture and reproducible; an inference is our reasoning over it; documented is the tool’s own statement; a classification is our adversarially-reviewed judgment. Observation never reads as inference.

Observed — directly in the capture, reproducible

• The tool sent 2 request(s) to api.forestadmin.com. — Captured in the sandbox run (published redacted in the evidence artifact); re-run the scan to reproduce. (confidence: high)

Documented — the tool's own statement

• The tool's own docs state (quoted): iew This MCP server provides HTTP REST API access to Forest Admin operations, enabling AI assistants and other MCP clients to interact with your Forest Admin data through a standardized protocol. ## — npm registry readme for @forestadmin/mcp-server (confidence: high)

Classified — our adversarially-reviewed judgment

• api.forestadmin.com is classified as egress (an observability side-channel, not required for the function). — Adversarially reviewed. (confidence: high)
• Disclosure status: disclosed. — The observed endpoint api.forestadmin.com is named/disclosed in the tool's own docs (matched: api). (confidence: high)

Method

Installed and run in an isolated container; fed traceable decoy data; all outbound traffic intercepted (TLS broken via own CA, iptables transparent redirect). Endpoints, resolved geo/jurisdiction and frequency are observed facts. Capture self-test passed.

Scope

Compares the tool's declared destinations against what was observed in one sandbox run. Checks transparency / integrity for a cooperative tool, NOT resistance to deliberate evasion. "honest"/"clean" means "observed without deviation within our reach", NOT "guaranteed no hidden egress". Out of scope: exfiltration split/chunked across requests; tool-side encryption of the payload before egress; input/time/state-triggered processing not triggered in the run.

Machine-readable verdict: /verdict/forestadmin.json. This page describes observed behaviour and its relation to the tool's own disclosures — it is not a legal judgment. Search context: does @forestadmin/mcp-server send data, @forestadmin/mcp-server privacy, @forestadmin/mcp-server data flow, @forestadmin/mcp-server telemetry, where does @forestadmin/mcp-server send data, is @forestadmin/mcp-server safe, what data does @forestadmin/mcp-server collect, how to disable @forestadmin/mcp-server telemetry, @forestadmin/mcp-server opt out tracking, @forestadmin/mcp-server GDPR data residency, @forestadmin/mcp-server third-party / jurisdiction.