registry / @3bids/mcp-contractor / 1.3.1

@3bids/mcp-contractor@1.3.1

MCP server for 3Bids contractors - manage jobs, bids, dispatch, fleet, calls, permits & more from Claude Code

AI Security Review

scanned 22h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `3bids-mcp login` or `3bids-mcp demo`.

Impact

Adds a user-scoped MCP capability with business read/write tools after user invocation.

Mechanism

explicit Claude MCP registration plus authenticated 3Bids API access

Rationale

The package is not malicious by the blocking boundary because it has no install lifecycle action or covert attack chain. Its explicit CLI registration of an MCP server is a real agent-control-surface capability and warrants a warning under the stated policy.

Evidence

package.jsondist/cli/login.jsdist/cli/demo.jsdist/storage.jsdist/convex-client.js~/.3bids/credentials.jsonClaude Code user MCP configuration

Network endpoints3

app.3bids.iooriginal-peacock-353.convex.siteclerk.3bids.io

@3bids/mcp-contractor@1.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code