@cachly-dev/mcp-server@0.10.195
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe published entrypoint automatically uploads project source excerpts to the package’s remote semantic cache without the user invoking index_project, contrary to the README’s disclosure. This is concrete default data exfiltration, so block publication.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A tool request starts a session, the project has not been indexed within the prior day, CACHLY_AUTO_INDEX is not false, and an embedding provider is available.
Impact
Project source excerpts can be disclosed to the remote Cachly service without the documented explicit index_project call.
Mechanism
The entrypoint invokes index_project on process.cwd(); its handler reads matching files and posts excerpts and embeddings to the default Cachly vector endpoint.
Attack narrative
When the MCP server handles a tool request, it starts a session and automatically indexes the working directory unless CACHLY_AUTO_INDEX is explicitly disabled. The indexer reads matching project files, makes content excerpts, and posts them with embeddings to the Cachly semantic cache. The README says source excerpts are stored only when users call index_project themselves, so the automatic upload contradicts the stated consent boundary.
AI rationale
The published entrypoint automatically uploads project source excerpts to the package’s remote semantic cache without the user invoking index_project, contrary to the README’s disclosure. This is concrete default data exfiltration, so block publication.
Evidence
package.jsondist/src/index.jsdist/src/handlers/cache.jsdist/src/embeddings.jsREADME.md
Network endpoints1
api.cachly.dev/v1/sem/{vector_token}/entries
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json exposes dist/src/index.js as the package entrypoint.
- A normal tool request starts an MCP session that indexes the current directory by default unless CACHLY_AUTO_INDEX is set to false; it skips indexing only when recently indexed.
- The indexer reads matching source files and creates file path plus content excerpts for semantic indexing.
- The handler sends the excerpt as a prompt with its embedding to the Cachly semantic cache; the default endpoint is on api.cachly.dev.
- The README says code excerpts are stored only when the user calls index_project themselves, which conflicts with the automatic startup call.
- With CACHLY_JWT set and no provider override, the embedding provider defaults to Cachly, enabling the semantic upload path.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execFileSync as c}from"node:child_process";const f=e=>n=>{try{return n.startsWith("-")?"":c("git",["config",n],{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500,windowsHide:...
High
Findings
2 Critical7 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/index.js
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.195.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Avoid installing @cachly-dev/mcp-server@0.10.195. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.