@cachly-dev/mcp-server@0.10.214
Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source confirms conditional token exposure to an unrestricted environment-configured endpoint, which warrants a warning. The default endpoint is the package’s service and the transfer requires a tool call and endpoint configuration, so the inspected behavior does not support a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A caller invokes cache_stats while CACHLY_VECTOR_URL points to a custom endpoint.
Impact
The configured endpoint receives a Cachly-issued token; the source does not establish that the token is usable beyond its vector service scope.
Mechanism
The handler places the token in the request URL path and sends a stats request without a destination allowlist.
AI rationale
The source confirms conditional token exposure to an unrestricted environment-configured endpoint, which warrants a warning. The default endpoint is the package’s service and the transfer requires a tool call and endpoint configuration, so the inspected behavior does not support a block.
Evidence
dist/src/handlers/cache.jsdist/src/index.js
Network endpoints1
api.cachly.dev
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When the cache_stats tool runs, it obtains an instance vector token and sends it in the request path to the URL set by CACHLY_VECTOR_URL, which defaults to api.cachly.dev; the MCP dispatcher routes tool calls to this handler.
- The main API client sends a bearer token to CACHLY_API_URL, which defaults to api.cachly.dev and can be overridden through the environment.
- The inspected runtime-operation locations resolve to application cache, memory, team, roadmap, and syndicate handlers; they do not establish a separate publisher-selected account action.
Evidence against
- The token transfer is conditional on a cache_stats tool call, and the default recipient is the package’s Cachly service; a custom recipient requires an environment override.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/autor.jsView file
1import{execFileSync as c}from"node:child_process";const f=e=>n=>{try{return n.startsWith("-")?"":c("git",["config",n],{cwd:e,encoding:"utf-8",stdio:"pipe",timeout:1500,windowsHide:...
High
Findings
1 Critical11 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/autor.js
HighSame File Env Network Executiondist/src/index.js
HighCredential Exfiltrationdist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
HighRuntime Package Installdist/src/cls-hook.js
HighSemantic Analysis Limiteddist/src/doctor.js#virtual:normalized:round1
HighKnown Malware Source Similarityhooks/cachly-ambient-einblendung.mjs
HighKnown Malware Source Similaritydist/src/handlers/cache.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @cachly-dev/mcp-server@0.10.214.
See all versions of @cachly-dev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @cachly-dev/mcp-server@0.10.214 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.