registry / @bastra-recall/daemon / 0.8.1

@bastra-recall/daemon@0.8.1

MCP server exposing recall + load_memory over a markdown vault.

AI Security Review

scanned 20h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package has an explicit CLI-based first-party AI-agent integration that writes MCP/skill registrations. A user-enabled auto-update mode can refresh the package and those registrations from an agent session; no install-time attack path is present.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `bastra install`, or previously enables `update.mode=auto` and starts a supported agent session.

Impact

Persistent agent capability and local-memory guidance can be enabled across supported AI clients; no confirmed exfiltration or destructive action.

Mechanism

First-party AI-client configuration registration and staged self-update

Rationale

No install hook, credential exfiltration, remote payload loader, or foreign/broad AI-agent mutation was found. The package nevertheless provides persistent AI-agent integration and an opt-in unattended update path, so it merits a warning rather than a publication block.

Evidence

package.jsondist/mcp-forwarder.jsdist/settings.jsdist/session-hook.jsdist/cli/update.jsdist/cli/adapters/claude-code.jsskill/SKILL.mddist/cli/adapters/cursor.jsdist/cli/adapters/claude-desktop.js

Network endpoints3

api.github.com/repos/n0mad-ai/bastra-recall/releases/latest

@bastra-recall/daemon@0.8.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code