Security review checklist for OfflineCreator MCP

Start with the endpoint and transport boundary

Record the exact connection you are approving. OfflineCreator currently recommends the remote OAuth endpoint at https://mcp.offlinecreatorstudio.com/mcp. Its product page also documents local stdio and a legacy remote API-key connection through @offlinecreator/mcp. Remote OAuth keeps a personal API key out of the client configuration; a stdio fallback still requires a key in secret configuration.

Treat transport choice as a security decision, not a convenience toggle. For remote use, verify HTTPS, the expected host, browser consent, and the Authorization header before allowing tools. For stdio, verify the package name and version, executable, working directory, environment-variable source, and who can change the client configuration. The published package defaults its Studio API base to https://offlinecreatorstudio.com, restricts ordinary remote bases to a short host allowlist, and permits insecure or nonstandard bases only through explicit local or override conditions.

Remote OAuth

Verify the canonical HTTPS resource before consentReject lookalike hosts, copied query-string credentials, and unexplained endpoint changes.

Local stdio

Pin the package and constrain its environmentReview the executable, upload root, API-key source, working directory, and update process together.

Verify OAuth metadata and the granted scope

Fetch both discovery documents from the host you intend to authorize. The current protected-resource metadata names the MCP resource, its authorization server, models, read, and generate scopes, and header-based bearer authentication. The authorization-server metadata advertises authorization-code and refresh-token grants, a revocation endpoint, and S256 PKCE. Discovery proves what the server advertises; it is not an independent test that every exchange, audience check, or revocation path behaves correctly.

Compare the live flow with the July 28, 2026 MCP authorization requirements. Clients must send a resource indicator and verify PKCE support, while servers must accept only tokens intended for their resource and must not pass the inbound MCP token to an upstream API. In an acceptance test, inspect the consent screen, request the smallest scope set, reconnect, and compare the visible tools with the grant.

models

Catalog inspectionUse for model and published-cost discovery without account-history or generation access.

read

Credits and generation recordsGrant only when the client needs account state, job status, or output retrieval.

generate

Create, upload, and cancelReserve for clients authorized to spend credits and handle source or generated media.

Compare scopes with the tool registry

The published @offlinecreator/mcp 0.1.1 server maps list_models to models; balance, generation-history, status, waiting, and download tools to read; and generation, upload, and cancellation tools to generate. When it receives a nonempty scope list, it omits tools whose mapped scope is absent. When scopes are missing or empty, this published implementation registers all mapped tools, so an absent scope list must not be interpreted as least privilege.

Review the actual post-connection registry, not only the requested scope string. A read-only review should not expose generation or upload. A catalog-only connection should not expose credits, history, or output retrieval. Record any difference between the authorization grant and the visible registry as a failed control, and retest after package, server, or client updates.

Inspect secret, log, and revocation handling

For personal API keys, OfflineCreator's current privacy policy says the secret is shown once, retained only as a one-way hash with a display prefix, scopes, and last-used timestamps, and excluded from application logs. It says users can revoke one key or all keys in Settings. Sampled API request logs may include route, status code, key identifier, and a truncated one-way network-address hash, with sampled security and audit logs retained for up to 12 months.

Keep those statements within their documented boundary. The public policy does not disclose the key-hashing construction, demonstrate every application log path, or establish the precise invalidation timing of a revoked credential. Test revocation with a disposable credential: make a permitted request, revoke that key or OAuth connection, retry without changing the client, and record the response. Never use a production credential as review evidence.

Storage

Secret configuration onlyExclude keys and tokens from URLs, repositories, chat transcripts, screenshots, and copied diagnostics.

Revocation

Test a disposable credentialVerify the old credential fails and that unrelated keys or grants retain only their intended access.

Constrain local uploads before enabling generate

Local file-path upload is a stdio capability, not a reason to give an agent general filesystem access. The published package resolves a configured upload root, rejects paths outside that root, allows only png, jpg, jpeg, webp, and gif extensions, requires a regular nonempty file, caps input at 10 MiB, and checks image signatures.

The package client disables local file-path upload when no local-image reader is configured, validates generation identifiers as UUIDs, restricts API calls to /api/v1 paths, refuses automatic redirects, and omits output URLs outside the configured Studio origin. These are useful published controls, not proof against every filesystem race or a compromised dependency. Point OFFLINECREATOR_UPLOAD_ROOT at a dedicated review folder containing only approved inputs, then test traversal, a misleading extension, oversized content, and mismatched bytes.

Record the result, gaps, and next review date

A pass means the reviewer captured the canonical endpoint, transport, discovery metadata, granted scopes, visible tools, secret location, upload root, sampled-log disclosure, revocation result, and both Studio and provider data boundaries. Attach dates and source versions to the record. Product claims on this page were checked on August 9, 2026 and should be refreshed by September 8, 2026 under the monthly cadence.

This research is not a penetration test, independent security audit, or certification. Recent community evidence was generic, incomplete, and insufficient to verify OfflineCreator controls, adoption, customer outcomes, or external validation. No community claim is used in the checklist.