registry / @cachly-dev/mcp-server / 0.10.194
@cachly-dev/mcp-server@0.10.194
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package’s setup command installs persistent Git and agent hooks that perform later automatic actions. Because setup is explicitly invoked and the inspected transfer defaults to Cachly’s service, the source supports a capability warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs setup or autopilot; after installation, each commit triggers the Git hook.
Impact
Commit messages, hashes, and changed file paths are sent to the configured Cachly instance; the hooks remain active until removed.
Mechanism
Setup writes a Git post-commit hook and agent hook scripts and settings. The Git hook launches the package’s commit-ingest command with commit details.
AI rationale
The package’s setup command installs persistent Git and agent hooks that perform later automatic actions. Because setup is explicitly invoked and the inspected transfer defaults to Cachly’s service, the source supports a capability warning rather than a malicious verdict.
Evidence
package.jsonscripts/postinstall.jsdist/src/index.jsdist/src/cls-hook.jsdist/src/ambient-hooks.jshooks/cachly-ambient-einblendung.mjsdist/src/credentials.js.git/hooks/post-commit.claude/hooks/.claude/settings.json
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall prints setup directions; hook installation is behind the separately invoked setup or autopilot command.
- After setup, the package installs a Git post-commit hook and Claude hooks that are wired into project settings.
- The Git hook runs on each commit, gathers the commit message, hash, and changed paths, then submits them through the Cachly server to the selected instance.
- The package’s default service endpoint is api.cachly.dev, and its ambient hooks obtain Cachly credentials from the environment or Cachly configuration.
Evidence against
- The inspected setup is explicit and package-owned, and the reviewed transfer path defaults to the Cachly service; source inspection did not establish an unrelated recipient or covert credential theft.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execFileSync as c}from"node:child_process";const f=e=>n=>{try{return n.startsWith("-")?"":c("git",["config",n],{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500,windowsHide:...
High
Findings
1 Critical7 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/index.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.194.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.194 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.