registry / @baizor/gamedev-cli-core / 0.1.0

@baizor/gamedev-cli-core@0.1.0

Shared TypeScript CLI core for the AI Game Dev engine CLIs (Unity/Unreal/Godot): project identity/pin, OAuth device login, machine credential store, and setup-mcp/install-plugin logic. Consumed as thin adapters by the three engine CLIs.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A consuming CLI explicitly calls setup, enrollment, or server-download functions.

Impact

Can alter selected MCP client configuration or install a binary in an adapter-selected project directory.

Mechanism

User-invoked agent-config mutation and server-binary installation.

Rationale

The source confirms a real but explicit user-command AI-agent configuration and executable-install capability. It does not establish malicious behavior, persistence, or an unconsented lifecycle-triggered control-surface modification.

Evidence

package.jsondist/setup-mcp.jsdist/agents-registry.jsdist/enroll.jsdist/server-download.jsdist/machine-credentials.js~/.ai-game-dev/credentials.json.mcp.json.cursor/mcp.json~/Library/Application Support/Claude/claude_desktop_config.json

Network endpoints2

ai-game.dev/mcpgithub.com/IvanMurzak/GameDev-MCP-Server/releases/download/

@baizor/gamedev-cli-core@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code