registry / @agent-link/server / 0.1.490

@agent-link/server@0.1.490

AgentLink relay server

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The package is an intended local HTTP/WebSocket relay server. No unconsented install-time execution, external control-surface mutation, or exfiltration path was confirmed.

Static reason

No blocking static signals were detected.

Trigger

Explicit `agentlink-server start` or `agentlink-server service install` command.

Impact

It can expose its configured relay/proxy functionality while running, but source inspection found no stealth or malicious execution chain.

Mechanism

Local relay server with optional user-requested service registration and Entra token verification.

Rationale

The persistence and shell primitives implement explicitly invoked, package-owned server/service management. No install hook or concrete malicious behavior was found after direct source inspection.

Evidence

package.jsondist/cli.jsdist/service.jsdist/config.jsdist/state-persistence.jsdist/http.jsdist/entra.jsdist/index.jsdist/ws-agent.jsdist/ws-client.jsdist/tunnel.jsdist/encryption.js

Network endpoints2

@agent-link/server@0.1.490

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code