@cachly-dev/mcp-server@0.10.190
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found a first-party hook setup path that modifies editor configuration and enables authenticated context exchange with Cachly’s API. The npm postinstall only prints the setup command, so the inspected behavior supports a capability warning, not a block.
Decision evidence
public snapshot- The npm postinstall invokes a script that prints a suggested setup command; setup is activated by an explicit CLI command.
- That setup path installs Cachly hooks and writes or updates editor hook settings.
- The installed hook sends authenticated prompt or text context for recall and learning to Cachly’s configured service.
- The default API endpoint is api.cachly.dev.
- The reviewed setup behavior is package-aligned and user-invoked; the inspected sources do not establish credential theft or an unconsented install-time attack.
Source & flagged code
12 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.190.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.190 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.