@cachly-dev/mcp-server@0.10.142
Your AI forgets everything between sessions. cachly fixes that permanently: 123 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run. Arrives pre-briefed. Free tier forever, EU servers, GDPR.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a concrete credential-disclosure and global editor-configuration capability, but the behavior is service-aligned and not an opaque install-time attack. It should be warned for rather than blocked as malware.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the server with a token enables telemetry; completing device sign-in triggers configuration writes.
Impact
The vendor telemetry service receives a reusable API credential, and sign-in changes user-level AI-editor configuration.
Mechanism
Token-bearing telemetry and automatic MCP configuration updates.
AI rationale
The package contains a concrete credential-disclosure and global editor-configuration capability, but the behavior is service-aligned and not an opaque install-time attack. It should be warned for rather than blocked as malware.
Evidence
dist/src/index.js~/.claude/mcp.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json
Network endpoints2
api.cachly.devauth.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- Runtime telemetry sends the active Cachly API token to the vendor telemetry endpoint unless an opt-out variable is set.
- A successful device sign-in writes the resulting token into global Claude configuration and updates existing Cursor and Windsurf configurations.
- The automatic postinstall hook only prints setup instructions; it does not perform the configuration writes.
Evidence against
- The observed network use and configuration changes implement the package's advertised MCP service rather than downloading or executing an opaque payload.
- There is no runtime dependency on another release of this package.
- Code indexing is exposed as a separate command rather than run by postinstall.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/bench/cachly-bench.jsView file
1import{EventEmitter as F}from"node:events";import{keywordSearch as $}from"../search.js";import{rerankByQuality as x}from"../rerank.js";import{BENCH_LESSONS as q,BENCH_QUERIES as B}...
L2: `)}const j=(()=>{try{return import.meta.url===`file://${process.argv[1]}`||process.argv[1]?.endsWith("cachly-bench.ts")||process.argv[1]?.endsWith("cachly-bench.js")}catch{return!1...
High
Child Process
Package source references child process execution.
dist/src/bench/cachly-bench.jsView on unpkg · L1dist/src/tools.jsView file
9Returns the copilot-instructions.md content + provider-specific .mcp.json snippet.
L10: Optionally writes copilot-instructions.md directly to the project directory.`,inputSchema:{type:"object",properties:{instance_id:{type:"string",description:"UUID of the cachly inst...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/tools.jsView on unpkg · L9dist/src/confidence.jsView file
1import{createHash as i}from"node:crypto";const n=Number(process.env.CACHLY_CONFIDENCE_WARN_DAYS??5),d=Number(process.env.CACHLY_CONFIDENCE_STALE_DAYS??10),o=.7,s=.5;function p(e){c...
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/src/confidence.jsView on unpkg · L1dist/src/index.jsView file
1#!/usr/bin/env node
L2: import{jwtExpiryMs as ft,checkJwt as ht,handleApiError as yt,diagnoseAuth as ge,planAuthHeal as Ce,readClientCredentialsFromEnv as bt,buildClientCredentialsBody as vt,clientCredent...
L3:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/index.jsView on unpkg · L11#!/usr/bin/env node
L2: import{jwtExpiryMs as ft,checkJwt as ht,handleApiError as yt,diagnoseAuth as ge,planAuthHeal as Ce,readClientCredentialsFromEnv as bt,buildClientCredentialsBody as vt,clientCredent...
L3:
...
L25: \u2022 Technical detail: ${a}`)}return K.set(e,o),o}async function O(e,t={},n=!1){n||Ce(ge(x))!=="none"&&await be(),ht(x);const s=Number(process.env.CACHLY_API_TIMEOUT_MS??15e3),o=...
L26: `)}const c=await jt();return c?(G=c,A("device_flow_started",{tool:e}),ie(c.verifyUrl,(b,g)=>{if(b){A("device_browser_opened",{stelle:"tool"});return}A("device_browser_failed",{reas...
L27: cachly: could not open a browser (${g??"unknown"}).
...
L62:
L63: The Brain instance id comes from the CACHLY_BRAIN_INSTANCE_ID environment variable.`,ot={tools:{},resources:{},prompts:{}},nt=asy
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/src/index.jsView on unpkg · L1174`);try{const $=await fetch(`${w}/api/v1/auth/device/code`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_id:"cachly-mcp-cli"}),signal:AbortS...
L175: `);const I=(k.interval??5)*1e3;for(let H=0;H<24;H++){await new Promise(T=>setTimeout(T,I));try{const T=await fetch(`${w}/api/v1/auth/device/token`,{method:"POST",headers:{"Content-...
L176: \u274C Sign-in timed out. Run the command again.
...
L181: `),console.log(" \u{1F4DB} Add the badge to your README:"),console.log(` npx @cachly-dev/mcp-server@latest badge
L182: `)),process.exit(0)}if(process.argv[2]==="upgrade"){process.stdout.write(`
L183: \u23F3 Checking for updates...
...
L189: \u274C bench failed: ${l.message}
L190: `),process.exit(1)}process.exit(0)}if(process.argv[2]==="demo"){const
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/index.jsView on unpkg · L1741#!/usr/bin/env node
L2: import{jwtExpiryMs as ft,checkJwt as ht,handleApiError as yt,diagnoseAuth as ge,planAuthHeal as Ce,readClientCredentialsFromEnv as bt,buildClientCredentialsBody as vt,clientCredent...
L3:
...
L25: \u2022 Technical detail: ${a}`)}return K.set(e,o),o}async function O(e,t={},n=!1){n||Ce(ge(x))!=="none"&&await be(),ht(x);const s=Number(process.env.CACHLY_API_TIMEOUT_MS??15e3),o=...
L26: `)}const c=await jt();return c?(G=c,A("device_flow_started",{tool:e}),ie(c.verifyUrl,(b,g)=>{if(b){A("device_browser_opened",{stelle:"tool"});return}A("device_browser_failed",{reas...
L27: cachly: could not open a browser (${g??"unknown"}).
...
L62:
L63: The Brain instance id comes from the CACHLY_BRAIN_INSTANCE_ID environment variable.`,ot={tools:{},resources:{},prompts:{}},nt=asy
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/index.jsView on unpkg · L11Trigger-reachable credential exfiltration chain: scripts.start -> dist/src/index.js
L1: #!/usr/bin/env node
L2: import{jwtExpiryMs as ft,checkJwt as ht,handleApiError as yt,diagnoseAuth as ge,planAuthHeal as Ce,readClientCredentialsFromEnv as bt,buildClientCredentialsBody as vt,clientCredent...
L3:
...
L25: \u2022 Technical detail: ${a}`)}return K.set(e,o),o}async function O(e,t={},n=!1){n||Ce(ge(x))!=="none"&&await be(),ht(x);const s=Number(process.env.CACHLY_API_TIMEOUT_MS??15e3),o=...
L26: `)}const c=await jt();return c?(G=c,A("device_flow_started",{tool:e}),ie(c.verifyUrl,(b,g)=>{if(b){A("device_browser_opened",{stelle:"tool"});return}A("device_browser_failed",{reas...
L27: cachly: could not open a browser (${g??"unknown"}).
...
L62:
L63: The Brain instance id comes from the CACHLY_B
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/src/index.jsView on unpkg · L1174Trigger-reachable command-output exfiltration chain: scripts.start -> dist/src/index.js
L174: `);try{const $=await fetch(`${w}/api/v1/auth/device/code`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_id:"cachly-mcp-cli"}),signal:AbortS...
L175: `);const I=(k.interval??5)*1e3;for(let H=0;H<24;H++){await new Promise(T=>setTimeout(T,I));try{const T=await fetch(`${w}/api/v1/auth/device/token`,{method:"POST",headers:{"Content-...
L176: \u274C Sign-in timed out. Run the command again.
...
L181: `),console.log(" \u{1F4DB} Add the badge to your README:"),console.log(` npx @cachly-dev/mcp-server@latest badge
L182: `)),process.exit(0)}if(process.argv[2]==="upgrade"){process.stdout.write(`
L183: \u23F3 Checking for updates...
...
L189: \u274C bench failed:
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/src/index.jsView on unpkg · L174dist/src/cls-hook.jsView file
6`+o+`
L7: `,"utf-8"),await c(t,493).catch(()=>{}),"appended"}const _="try{var p={instance_id:process.env.CACHLY_BRAIN_INSTANCE_ID,source:'git_commit',payload:{message:process.env.CLS_MSG||''...
L8: `)}export{u as CLS_HOOK_VERSION,L as buildClsPostCommitHook,v as installClsPostCommitHook};
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/src/cls-hook.jsView on unpkg · L6dist/src/doctor.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/doctor.js#virtual:normalized:round1View on unpkgdist/src/handlers/brain.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cachly-dev/mcp-server@0.10.141
matchedIdentity = npm:QGNhY2hseS1kZXYvbWNwLXNlcnZlcg:0.10.141
similarity = 0.964
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/handlers/brain.jsView on unpkgFindings
1 Critical10 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/src/handlers/brain.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/bench/cachly-bench.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighSandbox Evasion Gated Capabilitydist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/tools.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/src/confidence.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.142.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.142 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.