registry / @agent-link/server / 0.1.484

@agent-link/server@0.1.484

AgentLink relay server

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a local relay server with optional explicit service installation and Entra authentication.

Static reason

No blocking static signals were detected.

Trigger

User runs agentlink-server start, install, update, or configures Entra authentication.

Impact

Can relay connected agent traffic and install its own service when explicitly requested; no unconsented install-time action found.

Mechanism

Local HTTP/WebSocket relay with explicit daemon/service management.

Rationale

Source inspection shows an explicit-user-operated AgentLink relay server. Persistence and command execution are limited to named CLI service/daemon/update operations, with no install-time mutation or concrete malicious chain.

Evidence

package.jsondist/cli.jsdist/service.jsdist/index.jsdist/entra.jsdist/tunnel.jsdist/config.jsdist/state-persistence.jsdist/auth-manager.jsdist/http.jsdist/ws-agent.js

Network endpoints1

@agent-link/server@0.1.484

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code