registry / @aisystemresources/emdee / 0.1.2

@aisystemresources/emdee@0.1.2

Local-first document management with markdown rendering, knowledge graph, and MCP server.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package provides explicit local document-management and stdio MCP capabilities scoped to the caller-selected docs directory.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit `emdee` CLI command or `emdee mcp` invocation.

Impact

Can read, create, edit, trash, or delete markdown within the configured local vault; this is the documented package function.

Mechanism

User-invoked local vault management and stdio MCP server.

Rationale

Static source inspection finds no install-time execution or concrete malicious chain. Scanner hits correspond to documented, explicitly invoked CLI/MCP document tooling; the image fetch is a user-requested capability, not evidence of exfiltration.

Evidence

package.jsonbin/emdee.jssrc/mcp/server.tssrc/lib/mcp/tools/vault.tssrc/lib/mcp/tools/get_image.tssrc/lib/storage/index.ts

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with medium false-positive risk.

Evidence for block

`bin/emdee.js` uses `spawn`, but only after explicit CLI subcommands and with fixed executable/argument arrays.

@aisystemresources/emdee@0.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code