@cachly-dev/mcp-server@0.10.184
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: 124 MCP tools for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe runtime conditionally forwards an existing JWT to a configurable endpoint, which warrants a warning about credential exposure. The inspected source does not establish an unrelated default recipient or another concrete attack, so this does not support blocking the package.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The MCP server starts and emits its startup telemetry event while telemetry is enabled.
Impact
A custom API endpoint could receive the caller's existing JWT; source inspection does not show theft to an unrelated default recipient.
Mechanism
The telemetry request includes the JWT in its JSON body and uses the API base URL selected from the environment, which defaults to the Cachly API.
AI rationale
The runtime conditionally forwards an existing JWT to a configurable endpoint, which warrants a warning about credential exposure. The inspected source does not establish an unrelated default recipient or another concrete attack, so this does not support blocking the package.
Evidence
dist/src/index.js
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runtime accepts an environment-configured API base URL, defaulting to the Cachly API.
- Telemetry posts to that base URL and includes the existing JWT unless telemetry is disabled; startup triggers a telemetry event.
- The integration locations inspected concern Cachly credentials, Cachly configuration, or plugin version discovery; they do not establish an unrelated agent-control attack.
- The postinstall hook prints setup guidance, while the package manifest identifies the runtime entrypoint.
Evidence against
- The telemetry destination defaults to the package's own API service, and an environment variable can disable telemetry.
- The inspected source does not establish credential theft to an unrelated recipient or a destructive attack.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execSync as c}from"node:child_process";const f=e=>n=>{try{return c(`git config ${n}`,{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500}).trim()}catch{return""}};function t(e...
High
Findings
2 Critical11 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighShell
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighSandbox Evasion Gated Capabilitydist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
High
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.184.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.184 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.