registry / @cachly-dev/mcp-server / 0.10.133

@cachly-dev/mcp-server@0.10.133

Your AI forgets everything between sessions. cachly fixes that permanently: 123 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run. Arrives pre-briefed. Free tier forever, EU servers, GDPR.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is not confirmed malware, but its runtime can automatically establish and persist an AI-agent extension after authentication. This warrants a warning for extension lifecycle risk rather than a publish block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the MCP server and completing device login, or invoking its setup/autopilot commands.

Impact

Future AI-agent sessions can be configured to execute this package and use the persisted Cachly account.

Mechanism

MCP configuration and hook installation with persisted Cachly credentials.

AI rationale

Evidence

dist/src/index.jsdist/src/ambient-hooks.jsdist/src/cls-hook.js~/.claude/mcp.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json.claude/settings.json.claude/hooks/cachly-ambient-session-start.mjs.claude/hooks/cachly-ambient-prompt-submit.mjs.claude/hooks/cachly-ambient-pre-tool.mjs.claude/hooks/cachly-ambient-stop.mjs

Network endpoints2

api.cachly.devauth.cachly.dev

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The runtime entrypoint can persist Cachly credentials and instance IDs into existing Claude, Cursor, and Windsurf MCP configuration files after its device-login flow.
Its explicit setup commands can create editor configuration and hook files that launch this package on future AI-agent events.
The package sends its configured Cachly token only to Cachly API and authentication endpoints; static inspection found no confirmed transfer to an unrelated recipient.

Evidence against

The install lifecycle invokes only scripts/postinstall.js, which prints setup instructions and does not itself modify files or make network requests.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

14 flagged

package.jsonView file

Lines 16-56json

16 "cachly-mcp": "dist/src/index.js"

17 },

18 "main": "./dist/src/index.js",

19 "scripts": {

20 "count-tools": "node scripts/count-tools.mjs",

21 "tool-catalog": "node scripts/tool-catalog.mjs summary",

22 "tool-catalog:json": "node scripts/tool-catalog.mjs json",

23 "tool-catalog:markdown": "node scripts/tool-catalog.mjs markdown",

24 "capability-docs": "node scripts/capability-docs.mjs markdown",

25 "capability-docs:write": "node scripts/capability-docs.mjs write",

26 "verify-capability-docs": "node scripts/capability-docs.mjs check",

27 "docs-atlas": "node scripts/docs-atlas.mjs summary",

28 "docs-atlas:write": "node scripts/docs-atlas.mjs write",

29 "verify-docs-atlas": "node scripts/docs-atlas.mjs check",

30 "tool-spec-snapshots:write": "node scripts/tool-spec-snapshots.mjs write",

31 "version": "node scripts/nummer-nachziehen.mjs && npm run tool-spec-snapshots:write",

32 "verify-tool-spec-snapshots": "node scripts/tool-spec-snapshots.mjs check",

33 "verify-tool-counts": "node scripts/verify-tool-counts.mjs",

34 "verify-capabilities": "node scripts/verify-capabilities.mjs",

35 "build": "tsc && node scripts/paket-schliessen.mjs && node scripts/bauabdruck.mjs",

36 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "dev": "tsx src/index.ts",

38 "start": "node dist/src/index.js",

39 "test": "vitest run",

40 "test:watch": "vitest",

41 "bench": "tsx src/bench/echter-korpus.ts",

42 "bench:spielzeug": "tsx src/bench/cachly-bench.ts",

43 "bench:external": "tsx src/bench/external-corpus.ts",

44 "bench:onboarding": "tsx src/bench/onboarding-bench.ts",

45 "bench:gate": "tsx src/bench/gate.ts",

46 "test:e2e": "bash scripts/e2e-run.sh",

47 "test:e2e:api": "bash scripts/e2e-run.sh api",

48 "test:e2e:cli": "bash scripts/e2e-run.sh cli",

49 "test:e2e:tools": "bash scripts/e2e-run.sh tools",

50 "test:e2e:funnel": "bash scripts/e2e-run.sh funnel",

51 "test:e2e:provisioning": "bash scripts/e2e-run.sh provisioning",

52 "lint": "eslint src",

53 "typecheck": "tsc --noEmit",

54 "bench:cost": "tsx src/bench/cost.ts"

55 },

56 "dependencies": {

dist/src/autor.jsView file

Lines 1-2javascript

1import{execSync as c}from"node:child_process";const f=e=>n=>{try{return c(`git config ${n}`,{cwd:e,encoding:"utf-8",stdio:"pipe"

dist/src/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{jwtExpiryMs as gt,checkJwt as ft,handleApiError as ht,diagnoseAuth as ge,planAuthHeal as $e,readClientCredentialsFromEnv as yt,buildClientCredentialsBody as bt,clientCredentialsTokenUrl as vt}from"./auth.js";import{cachlyUrl as N}

dist/src/confidence.jsView file

Lines 1-2javascript

1import{createHash as i}from"node:crypto";const n=Number(process.env.CACHLY_CONFIDENCE_WARN_DAYS??5),d=Number(process.env.CACHLY_CONFIDENCE_STALE_DAYS??10),o=.7

dist/src/cls-hook.jsView file

6`+o+` L7: `,"utf-8"),await c(t,493).catch(()=>{}),"appended"}const _="try{var p={instance_id:process.env.CACHLY_BRAIN_INSTANCE_ID,source:'git_commit',payload:{message:process.env.CLS_MSG||''... L8: `)}export{u as CLS_HOOK_VERSION,L as buildClsPostCommitHook,v as installClsPostCommitHook};

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cls-hook.jsView on unpkg · L6

dist/src/doctor.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/doctor.js#virtual:normalized:round1View on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/autor.jsView file

1import{execSync as c}from"node:child_process";const f=e=>n=>{try{return c(`git config ${n}`,{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500}).trim()}catch{return""}};function t(e...

High

Child Process

Package source references child process execution.

dist/src/autor.jsView on unpkg · L1

Findings

1 Critical11 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/src/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/autor.js

HighShell

HighSame File Env Network Executiondist/src/index.js

HighCredential Exfiltrationdist/src/index.js

HighCommand Output Exfiltrationdist/src/index.js

HighSandbox Evasion Gated Capabilitydist/src/index.js

HighTrigger Reachable Credential Exfiltrationdist/src/index.js

HighTrigger Reachable Command Output Exfiltrationdist/src/index.js

HighRuntime Package Installdist/src/cls-hook.js

HighSemantic Analysis Limited

Affected versions and remediation

This report applies to @cachly-dev/mcp-server@0.10.133.

See all versions of @cachly-dev/mcp-server for other recorded verdicts.

Review the evidence and your use of @cachly-dev/mcp-server@0.10.133 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 15:49:06.732Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code