@canonry/canonry@7.78.3
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected findings are consistent with the package's provider integrations, local authentication, and user-invoked CLI functions. The source reviewed does not show unauthorized credential collection, unrelated exfiltration, or harmful automatic behavior.
Decision evidence
public snapshot- The manifest exposes a CLI and library and declares build, typecheck, test, and lint scripts, with no install lifecycle script.
- The OpenRouter adapter uses OpenRouter's documented API endpoint and sends its configured API key there.
- The provider settings route accepts an API key and optional base URL as part of an explicit provider configuration request.
Source & flagged code
8 flaggedPackage source references child process execution.
dist/chunk-PRCBHOVR.jsView on unpkg · L60653Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/chunk-PRCBHOVR.jsView on unpkgFindings
Affected versions and remediation
This report applies to @canonry/canonry@7.78.3.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.78.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.