registry / @agent-link/server / 0.1.485

@agent-link/server@0.1.485

AgentLink relay server

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The package is a user-invoked local relay server with WebSocket connections and an optional configured port proxy. No malicious install-time or hidden runtime attack chain is established.

Static reason

No blocking static signals were detected.

Trigger

Running agentlink-server start, service install, upgrade, or connecting a configured agent/web client.

Impact

Intended users can expose configured agent sessions and allowed local ports; this is package-aligned functionality rather than covert behavior.

Mechanism

Authenticated AgentLink relay, optional Entra validation, and explicitly enabled agent-port tunneling.

Rationale

Direct inspection shows a package-aligned relay server whose persistence, network use, and process control are activated by explicit user CLI actions. No concrete malicious behavior or unconsented installation-time control-surface mutation was found.

Evidence

package.jsondist/cli.jsdist/service.jsdist/config.jsdist/state-persistence.jsdist/index.jsdist/ws-client.jsdist/ws-agent.jsdist/tunnel.jsdist/entra.js

Network endpoints1

@agent-link/server@0.1.485

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code