registry / @cachly-dev/mcp-server / 0.10.121

@cachly-dev/mcp-server@0.10.121

Your AI forgets everything between sessions. cachly fixes that permanently. Persistent memory + causal root-cause analysis for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, git commit, and CI run automatically. Arrives pre-briefed. P

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is not confirmed malicious: the install hook is display-only and the risky behavior is in explicit user-invoked onboarding. It warrants a warning because setup makes broad, behavior-bearing AI-agent and git-hook changes and telemetry sends the configured JWT to the vendor API.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs cachly init, setup, or autopilot; later git commits trigger the installed hook.

Impact

The package can persist its MCP server and behavior-bearing instructions across project and global AI-agent configurations; the hook continuously exports limited git metadata.

Mechanism

AI-agent config/rule injection and credentialed commit-metadata upload

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/src/index.jsdist/src/cls-hook.jsdist/packages/telegram-notify/client.js.mcp.json.cursor/mcp.json.windsurf/mcp.json.vscode/mcp.json.continue/config.json.zed/settings.json~/.claude/mcp.jsonCLAUDE.mdAGENTS.md.github/copilot-instructions.md.cursor/rules/cachly.mdc.windsurfrules.clinerules.git/hooks/post-commit

Network endpoints3

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit setup writes MCP entries for several AI editors and global ~/.claude/mcp.json.
writeInstructions injects mandatory Cachly tool-use rules into CLAUDE.md, AGENTS.md, Copilot, Cursor, Windsurf, and Cline files.
Explicit setup installs a .git/hooks/post-commit hook that sends commit metadata through cachly cls-ingest.
Telemetry includes the configured JWT in requests to the Cachly API.

Evidence against

postinstall only prints an onboarding message; it performs no file or network action.
Config, instruction, and hook writes are reached only through explicit init/setup/autopilot commands.
Network use targets the package's Cachly API/auth services and declared functionality.
No source evidence of unrelated credential harvesting, remote payload execution, or install-time control-surface mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/bench/cachly-bench.jsView file

40get(key) { cmds.push(key); return this; }, L41: async exec() { L42: return cmds.map(k => [null, store.get(k) ?? null]);

High

Child Process

Package source references child process execution.

dist/src/bench/cachly-bench.jsView on unpkg · L40

dist/src/ambient-hooks.jsView file

59// discarded so a noisy npm can never corrupt the hook protocol. L60: ` const child = spawn('${jsString(cli)}', { shell: true, stdio: ['inherit', 'inherit', 'ignore'] });`, L61: ` child.on('error', () => process.exit(0));`,

High

Shell

Package source references shell execution.

dist/src/ambient-hooks.jsView on unpkg · L59

dist/src/tools.jsView file

2333'Existing lessons are NOT overwritten by default — pass overwrite=true to replace them. ' + L2334: 'Example: brain_import(instance_id="...", share_id="abc123", topic_prefix="imported")', L2335: inputSchema: {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/tools.jsView on unpkg · L2333

dist/src/confidence.jsView file

2// ── Confidence Decay Config ─────────────────────────────────────────────────── L3: export const CONFIDENCE_WARN_DAYS = Number(process.env.CACHLY_CONFIDENCE_WARN_DAYS ?? 5); L4: export const CONFIDENCE_STALE_DAYS = Number(process.env.CACHLY_CONFIDENCE_STALE_DAYS ?? 10);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/confidence.jsView on unpkg · L2

dist/src/handlers/cache.jsView file

31try { L32: pretty = JSON.stringify(JSON.parse(value), null, 2); L33: } ... L143: try { L144: const inst = await apiFetch(`/api/v1/instances/${instance_id}`); L145: if (inst.vector_token) { L146: const vectorBase = process.env.CACHLY_VECTOR_URL ?? 'https://api.cachly.dev'; L147: const statsRes = await fetch(`${vectorBase}/v1/sem/${inst.vector_token}/stats`, { ... L216: headers: { 'Content-Type': 'application/json' }, L217: body: JSON.stringify(searchPayload), L218: signal: AbortSignal.timeout(8000),

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/src/handlers/cache.jsView on unpkg · L31

31Trigger-reachable credential exfiltration chain: scripts.start -> dist/src/index.js -> dist/src/handlers/cache.js L31: try { L32: pretty = JSON.stringify(JSON.parse(value), null, 2); L33: } ... L143: try { L144: const inst = await apiFetch(`/api/v1/instances/${instance_id}`); L145: if (inst.vector_token) { L146: const vectorBase = process.env.CACHLY_VECTOR_URL ?? 'https://api.cachly.dev'; L147: const statsRes = await fetch(`${vectorBase}/v1/sem/${inst.vector_token}/stats`, { ... L216: headers: { 'Content-Type': 'application/json' }, L217: body: JSON.stringify(searchPayload), L218: signal: AbortSignal.timeout(8000),

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/src/handlers/cache.jsView on unpkg · L31

dist/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cachly-dev/mcp-server@0.10.117 matchedIdentity = npm:QGNhY2hseS1kZXYvbWNwLXNlcnZlcg:0.10.117 similarity = 0.839 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/index.jsView on unpkg

5import { createRequire } from 'node:module'; L6: import { execFile } from 'node:child_process'; L7: // True only when this file is the entry point (not imported by tests or other modules). ... L40: * Configuration (env vars): L41: * CACHLY_API_URL – default https://api.cachly.dev L42: * CACHLY_JWT – your JWT (Keycloak access token) ... L53: // Reassigned (if at all) before any network call is made. L54: let API_URL = process.env.CACHLY_API_URL ?? 'https://api.cachly.dev'; L55: let JWT = process.env.CACHLY_JWT ?? ''; L56: const _EMBED_MODEL = process.env.CACHLY_EMBED_MODEL ?? ''; L57: // Resolve the package version at runtime from package.json so the telemetry L58: // `version` field always matches the published npm version. A hardcoded constant

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/src/index.jsView on unpkg · L5

dist/src/cls-hook.jsView file

69"files:(process.env.CLS_FILES||'').split(',').filter(Boolean)}};" + L70: "require('child_process').execFileSync('npx',['@cachly-dev/mcp-server@latest','cls-ingest',JSON.stringify(p)]," + L71: "{stdio:'ignore',timeout:8000});" +

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cls-hook.jsView on unpkg · L69

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/bench/cachly-bench.jsView file

40get(key) { cmds.push(key); return this; }, L41: async exec() { L42: return cmds.map(k => [null, store.get(k) ?? null]);

High

Child Process

Package source references child process execution.

dist/src/bench/cachly-bench.jsView on unpkg · L40

Findings

1 Critical9 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/src/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/bench/cachly-bench.js

HighShelldist/src/ambient-hooks.js

HighCredential Exfiltrationdist/src/handlers/cache.js

HighHost Fingerprint Exfiltrationdist/src/index.js

HighSandbox Evasion Gated Capabilitydist/src/index.js

HighExternal Ai Agent Control Surface Mutationdist/src/index.js

HighTrigger Reachable Credential Exfiltrationdist/src/handlers/cache.js

HighRuntime Package Installdist/src/cls-hook.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

Affected versions and remediation

This report applies to @cachly-dev/mcp-server@0.10.121.

See all versions of @cachly-dev/mcp-server for other recorded verdicts.

Review the evidence and your use of @cachly-dev/mcp-server@0.10.121 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-07 23:42:27.569Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code