@cachly-dev/mcp-server@0.10.136
Your AI forgets everything between sessions. cachly fixes that permanently: 123 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run. Arrives pre-briefed. Free tier forever, EU servers, GDPR.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete malicious install-time behavior, but explicit setup creates persistent Git and AI-agent hooks that execute the package and transmit project-derived data. Warn rather than block under the stated explicit-user-command policy.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the package's init, autopilot, or related setup command in a project.
Impact
Commit metadata and configured Cachly credentials can be used by later Cachly hook executions.
Mechanism
Explicit installation of Git and agent lifecycle hooks that invoke Cachly commands.
AI rationale
This is not concrete malicious install-time behavior, but explicit setup creates persistent Git and AI-agent hooks that execute the package and transmit project-derived data. Warn rather than block under the stated explicit-user-command policy.
Evidence
package.jsonscripts/postinstall.jsdist/src/index.jsdist/src/cls-hook.jsdist/src/ambient-hooks.jsdist/src/auth.js.git/hooks/post-commit.claude/hooks.claude/settings.json
Network endpoints2
api.cachly.devcachly.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The postinstall hook only prints setup instructions; it does not alter files or contact a network service.
- An explicit CLI setup path installs a Git post-commit hook that collects commit metadata and invokes the latest package version.
- The explicit setup also installs Claude hooks that run the package for agent lifecycle events.
- Runtime telemetry includes the configured Cachly JWT in a request to the Cachly API.
Evidence against
- No unconsented install-time control-surface mutation was found.
- The lifecycle script is informational only.
- Agent and Git hook changes are reached through explicit CLI setup commands, not package installation.
- Observed network hosts and credentials are aligned with the package's Cachly service.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/bench/cachly-bench.jsView file
1import{EventEmitter as F}from"node:events";import{keywordSearch as $}from"../search.js";import{rerankByQuality as q}from"../rerank.js";import{BENCH_LESSONS as B,BENCH_QUERIES as k}...
L2: `)}const j=(()=>{try{return import.meta.url===`file://${process.argv[1]}`||process.argv[1]?.endsWith("cachly-bench.ts")||process.argv[1]?.endsWith("cachly-bench.js")}catch{return!1...
High
Child Process
Package source references child process execution.
dist/src/bench/cachly-bench.jsView on unpkg · L1dist/src/tools.jsView file
9Returns the copilot-instructions.md content + provider-specific .mcp.json snippet.
L10: Optionally writes copilot-instructions.md directly to the project directory.`,inputSchema:{type:"object",properties:{instance_id:{type:"string",description:"UUID of the cachly inst...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/tools.jsView on unpkg · L9dist/src/confidence.jsView file
1import{createHash as i}from"node:crypto";const n=Number(process.env.CACHLY_CONFIDENCE_WARN_DAYS??5),d=Number(process.env.CACHLY_CONFIDENCE_STALE_DAYS??10),o=.7,s=.5;function p(e){c...
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/src/confidence.jsView on unpkg · L1dist/src/index.jsView file
1#!/usr/bin/env node
L2: import{jwtExpiryMs as gt,checkJwt as ft,handleApiError as ht,diagnoseAuth as ge,planAuthHeal as $e,readClientCredentialsFromEnv as yt,buildClientCredentialsBody as bt,clientCredent...
L3:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/index.jsView on unpkg · L11#!/usr/bin/env node
L2: import{jwtExpiryMs as gt,checkJwt as ft,handleApiError as ht,diagnoseAuth as ge,planAuthHeal as $e,readClientCredentialsFromEnv as yt,buildClientCredentialsBody as bt,clientCredent...
L3:
...
L25: \u2022 Technical detail: ${r}`)}return Z.set(e,o),o}async function O(e,t={},n=!1){n||$e(ge(x))!=="none"&&await ye(),ft(x);const s=Number(process.env.CACHLY_API_TIMEOUT_MS??15e3),o=...
L26: `)}const c=await Bt();return c?(G=c,A("device_flow_started",{tool:e}),ie(c.verifyUrl,(b,g)=>{if(b){A("device_browser_opened",{stelle:"tool"});return}A("device_browser_failed",{reas...
L27: cachly: could not open a browser (${g??"unknown"}).
...
L62:
L63: The Brain instance id comes from the CACHLY_BRAIN_INSTANCE_ID environment variable.`,et={tools:{},resources:{},prompts:{}},tt=asy
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/src/index.jsView on unpkg · L1174`);try{const $=await fetch(`${_}/api/v1/auth/device/code`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_id:"cachly-mcp-cli"}),signal:AbortS...
L175: `);const I=(k.interval??5)*1e3;for(let H=0;H<24;H++){await new Promise(T=>setTimeout(T,I));try{const T=await fetch(`${_}/api/v1/auth/device/token`,{method:"POST",headers:{"Content-...
L176: \u274C Sign-in timed out. Run the command again.
...
L181: `),console.log(" \u{1F4DB} Add the badge to your README:"),console.log(` npx @cachly-dev/mcp-server@latest badge
L182: `)),process.exit(0)}if(process.argv[2]==="upgrade"){process.stdout.write(`
L183: \u23F3 Checking for updates...
...
L189: \u274C bench failed: ${l.message}
L190: `),process.exit(1)}process.exit(0)}if(process.argv[2]==="demo"){const
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/index.jsView on unpkg · L1741#!/usr/bin/env node
L2: import{jwtExpiryMs as gt,checkJwt as ft,handleApiError as ht,diagnoseAuth as ge,planAuthHeal as $e,readClientCredentialsFromEnv as yt,buildClientCredentialsBody as bt,clientCredent...
L3:
...
L25: \u2022 Technical detail: ${r}`)}return Z.set(e,o),o}async function O(e,t={},n=!1){n||$e(ge(x))!=="none"&&await ye(),ft(x);const s=Number(process.env.CACHLY_API_TIMEOUT_MS??15e3),o=...
L26: `)}const c=await Bt();return c?(G=c,A("device_flow_started",{tool:e}),ie(c.verifyUrl,(b,g)=>{if(b){A("device_browser_opened",{stelle:"tool"});return}A("device_browser_failed",{reas...
L27: cachly: could not open a browser (${g??"unknown"}).
...
L62:
L63: The Brain instance id comes from the CACHLY_BRAIN_INSTANCE_ID environment variable.`,et={tools:{},resources:{},prompts:{}},tt=asy
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/index.jsView on unpkg · L11Trigger-reachable credential exfiltration chain: scripts.start -> dist/src/index.js
L1: #!/usr/bin/env node
L2: import{jwtExpiryMs as gt,checkJwt as ft,handleApiError as ht,diagnoseAuth as ge,planAuthHeal as $e,readClientCredentialsFromEnv as yt,buildClientCredentialsBody as bt,clientCredent...
L3:
...
L25: \u2022 Technical detail: ${r}`)}return Z.set(e,o),o}async function O(e,t={},n=!1){n||$e(ge(x))!=="none"&&await ye(),ft(x);const s=Number(process.env.CACHLY_API_TIMEOUT_MS??15e3),o=...
L26: `)}const c=await Bt();return c?(G=c,A("device_flow_started",{tool:e}),ie(c.verifyUrl,(b,g)=>{if(b){A("device_browser_opened",{stelle:"tool"});return}A("device_browser_failed",{reas...
L27: cachly: could not open a browser (${g??"unknown"}).
...
L62:
L63: The Brain instance id comes from the CACHLY_B
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/src/index.jsView on unpkg · L1174Trigger-reachable command-output exfiltration chain: scripts.start -> dist/src/index.js
L174: `);try{const $=await fetch(`${_}/api/v1/auth/device/code`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_id:"cachly-mcp-cli"}),signal:AbortS...
L175: `);const I=(k.interval??5)*1e3;for(let H=0;H<24;H++){await new Promise(T=>setTimeout(T,I));try{const T=await fetch(`${_}/api/v1/auth/device/token`,{method:"POST",headers:{"Content-...
L176: \u274C Sign-in timed out. Run the command again.
...
L181: `),console.log(" \u{1F4DB} Add the badge to your README:"),console.log(` npx @cachly-dev/mcp-server@latest badge
L182: `)),process.exit(0)}if(process.argv[2]==="upgrade"){process.stdout.write(`
L183: \u23F3 Checking for updates...
...
L189: \u274C bench failed:
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/src/index.jsView on unpkg · L174dist/src/cls-hook.jsView file
6`+o+`
L7: `,"utf-8"),await c(t,493).catch(()=>{}),"appended"}const _="try{var p={instance_id:process.env.CACHLY_BRAIN_INSTANCE_ID,source:'git_commit',payload:{message:process.env.CLS_MSG||''...
L8: `)}export{u as CLS_HOOK_VERSION,L as buildClsPostCommitHook,v as installClsPostCommitHook};
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/src/cls-hook.jsView on unpkg · L6dist/src/handlers/brain.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cachly-dev/mcp-server@0.10.134
matchedIdentity = npm:QGNhY2hseS1kZXYvbWNwLXNlcnZlcg:0.10.134
similarity = 0.945
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/handlers/brain.jsView on unpkgFindings
1 Critical9 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/src/handlers/brain.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/bench/cachly-bench.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighSandbox Evasion Gated Capabilitydist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/tools.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/src/confidence.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.136.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.136 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.