registry / @3bids/mcp-contractor / 1.3.0

@3bids/mcp-contractor@1.3.0

MCP server for 3Bids contractors - manage jobs, bids, dispatch, fleet, calls, permits & more from Claude Code

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit `3bids-mcp login` or `3bids-mcp demo` invocation without the opt-out flags.

Impact

Changes the user-scoped Claude MCP configuration and enables this package's MCP server; no covert execution or credential exfiltration was confirmed.

Mechanism

Fixed-argument Claude MCP remove/add plus package credential storage and authenticated API calls.

Rationale

This is not malicious install-time behavior, but explicit CLI-driven mutation of an AI-agent control surface merits a warning under the stated policy. The remaining network, filesystem, and child-process uses are aligned with the advertised authenticated MCP service.

Evidence

package.jsondist/cli/login.jsdist/cli/demo.jsdist/storage.jsdist/index.jsdist/convex-client.js~/.3bids/credentials.json~/.3bids/mcp-config.json

Network endpoints3

app.3bids.iooriginal-peacock-353.convex.siteclerk.3bids.io

@3bids/mcp-contractor@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code