registry / @agent-link/server / 0.1.488

@agent-link/server@0.1.488

AgentLink relay server

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package starts an HTTP/WebSocket relay when explicitly started and can register a first-party auto-start service only through an explicit user CLI command.

Static reason

No blocking static signals were detected.

Trigger

User runs `agentlink-server start` or `agentlink-server service install`.

Impact

Provides the advertised relay and local daemon behavior; no unconsented install-time mutation or exfiltration was established.

Mechanism

Encrypted WebSocket relay with optional user-invoked service registration.

Rationale

Source inspection shows a package-aligned relay server with explicit CLI-controlled daemon/service features. Its persistence is first-party and user-invoked, while installation has no lifecycle execution.

Evidence

package.jsondist/cli.jsdist/service.jsdist/config.jsdist/state-persistence.jsdist/index.jsdist/entra.jsdist/ws-agent.jsdist/ws-client.jsdist/http.jsdist/tunnel.jsREADME.md

Network endpoints1

@agent-link/server@0.1.488

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code