registry / @cachly-dev/mcp-server / 0.10.178
@cachly-dev/mcp-server@0.10.178
Your AI forgets everything between sessions. cachly fixes that permanently: 124 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run. Arrives pre-briefed. Free tier forever, EU servers, GDPR.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package has a postinstall hook, but inspected evidence does not show that hook performing the configuration changes. Runtime code does update Cachly-owned agent configuration, while a separate JWT-writing helper’s invocation remains unresolved; this supports a warning, not a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Server runtime instance provisioning or an existing Cachly configuration; invocation of the JWT-writing helper was not established.
Impact
Local agent configuration may be modified and the Cachly credential may be stored there; inspected evidence does not establish credential theft or broader control-surface modification.
Mechanism
The code reads or writes Cachly configuration in Claude, Cursor, and Windsurf locations, updating the package's own entry.
AI rationale
The package has a postinstall hook, but inspected evidence does not show that hook performing the configuration changes. Runtime code does update Cachly-owned agent configuration, while a separate JWT-writing helper’s invocation remains unresolved; this supports a warning, not a block.
Evidence
dist/src/index.js
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package declares a postinstall script that runs scripts/postinstall.js.
- When the server creates an instance, it updates existing Cachly entries in Claude, Cursor, and Windsurf configuration with the instance ID.
- The runtime also contains code to add Cachly to Claude configuration and write its JWT, but its invocation was not established.
- The ambient hook module names Cachly-specific files under Claude hooks and settings.
- Credential helpers read the JWT from Cachly configuration or the environment.
- The agent-related source excerpts concern Cachly-specific configuration, credentials, and setup text.
Evidence against
- The postinstall hook is a setup message; inspected source does not establish that it performs the configuration writes.
- The configuration updates target an existing Cachly entry or name the package itself; no foreign agent control surface or credential recipient was established.
- The package’s default API endpoint is its own Cachly service.
Behavioral surface
ChildProcessDynamicRequire
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execSync as c}from"node:child_process";const f=e=>n=>{try{return c(`git config ${n}`,{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500}).trim()}catch{return""}};function t(e...
High
Findings
2 Critical11 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighShell
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighSandbox Evasion Gated Capabilitydist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
High
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.178.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.178 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.