@cachly-dev/mcp-server@0.10.192
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe runtime forwards an available JWT through telemetry and authenticated requests to an unrestricted configured API base. Because the default is package-aligned and an alternate recipient requires configuration, classify this as a conditional credential exposure risk and warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The MCP runtime sends telemetry or makes an authenticated API request while a JWT is available and CACHLY_API_URL points to an alternate host.
Impact
An alternate endpoint can receive the Cachly credential and may be able to use it against the account.
Mechanism
The runtime uses the configured base for requests and includes the JWT in telemetry JSON or as a Bearer token, without a host allowlist.
AI rationale
The runtime forwards an available JWT through telemetry and authenticated requests to an unrestricted configured API base. Because the default is package-aligned and an alternate recipient requires configuration, classify this as a conditional credential exposure risk and warn rather than block.
Evidence
dist/src/index.jsdist/src/credentials.js
Network endpoints2
api.cachly.devoperator-configured CACHLY_API_URL
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runtime resolves a JWT from environment variables or saved Cachly credentials and uses CACHLY_API_URL for authenticated requests; the default API host is api.cachly.dev.
- Telemetry includes the JWT in its request body unless telemetry is disabled. The runtime callers covered by the supplied locations reach these telemetry or Cachly API paths; a configured API URL is not restricted to an allowlist.
- The agent-related targets concern Cachly configuration, hooks, plugin-version checks, or user-facing guidance. The postinstall script only directs users to run the setup command.
- The package defines a postinstall hook, but its script prints setup guidance rather than performing the setup.
Evidence against
- The default API base is the package's Cachly service; source inspection did not establish a default transfer to an unrelated recipient.
- An arbitrary recipient requires an operator-provided CACHLY_API_URL override, so the source does not establish covert default exfiltration.
- Agent configuration and hook setup are associated with the explicit setup or autopilot command, not the postinstall hook.
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execFileSync as c}from"node:child_process";const f=e=>n=>{try{return n.startsWith("-")?"":c("git",["config",n],{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500,windowsHide:...
High
Findings
2 Critical7 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/index.js
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.192.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.192 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.