registry / @agent-link/server / 0.1.483

@agent-link/server@0.1.483

AgentLink relay server

AI Security Review

scanned 14h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an encrypted browser-to-agent relay with an explicit user-command service installer; persistence is package-owned and not install-time.

Static reason

No blocking static signals were detected.

Trigger

User runs `agentlink-server start` or explicitly runs `agentlink-server service install`.

Impact

Provides the advertised remote relay/proxy capability; no unconsented install-time mutation or exfiltration chain was established.

Mechanism

WebSocket relay, optional local-port proxy, and explicit first-party daemon setup.

Rationale

Static source inspection shows expected relay-server functionality and explicit service management, not malicious behavior. The persistence and shell primitives are user-invoked, first-party operational features, with no lifecycle-triggered execution or concrete malicious chain.

Evidence

package.jsonREADME.mddist/cli.jsdist/service.jsdist/http.jsdist/tunnel.jsdist/ws-agent.jsdist/ws-client.jsdist/state-persistence.jsdist/entra.js

Network endpoints2

@agent-link/server@0.1.483

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code