@cachly-dev/mcp-server@0.10.197
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 9d ago · by lpm-firewall-aiSource inspection confirms that ordinary MCP use automatically uploads project file excerpts by default, contrary to the package’s stated manual-only behavior. This is concrete runtime data exfiltration, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The first MCP tool call in a session, unless automatic indexing is disabled through an environment setting.
Impact
Project source excerpts are transmitted to the service without the user calling the indexing tool, despite the README describing indexing as user-invoked.
Mechanism
The server recursively selects up to 150 supported files from the current working directory, makes excerpts, embeds them, and posts them to the vector service.
Attack narrative
On the first MCP tool call, the server starts a session and launches default-on indexing for the working directory. The indexer collects up to 150 supported files and sends excerpts to the Cachly vector service. The README says code excerpts are stored only when the user calls index_project, which conflicts with this automatic path.
AI rationale
Source inspection confirms that ordinary MCP use automatically uploads project file excerpts by default, contrary to the package’s stated manual-only behavior. This is concrete runtime data exfiltration, so the package should be blocked.
Evidence
package.jsondist/src/index.jsdist/src/handlers/cache.jsREADME.md
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package manifest selects dist/src/index.js as its main entrypoint and command.
- A first MCP tool call starts a session; by default, that path runs index_project on the working directory at most once daily, with a limit of 150 files.
- The indexer recursively reads matching source and Markdown files, up to 200 KB each, and creates excerpts from their paths and contents.
- The indexer embeds and sends those excerpts to api.cachly.dev by default, with a configurable endpoint override.
- The README says code excerpts are stored only when the user calls index_project, contradicting the automatic indexing path.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execFileSync as c}from"node:child_process";const f=e=>n=>{try{return n.startsWith("-")?"":c("git",["config",n],{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500,windowsHide:...
High
Findings
2 Critical13 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
CriticalPrevious Version Dangerous Deltadist/src/einblendung.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/index.js
HighKnown Malware Source Similarityhooks/cachly-ambient-einblendung.mjs
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.197.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Avoid installing @cachly-dev/mcp-server@0.10.197. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.