registry / @ceraph/react-native-mcp / 0.5.0

@ceraph/react-native-mcp@0.5.0

MCP server for React Native and Expo development workflow

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs npx @ceraph/react-native-mcp init, starts the MCP server, or calls ceraph_init_* tools.

Impact

Adds a powerful local MCP server to agent clients and can control a dev app/device within the documented React Native workflow.

Mechanism

Explicit MCP client setup, auth token persistence, local dev signal polling, and iOS automation commands.

Rationale

Static inspection supports a warning for explicit user-command AI-agent config mutation and powerful local automation, not a publish block. The scanner's install-time and obfuscation signals are real but do not show unconsented postinstall mutation, exfiltration, or remote code execution.

Evidence

package.jsonREADME.mddist/index.jsdist/cli.jsdist/shim/boot.jsdist/shim/command-poll.jsdist/shim/signal-transport.jsdist/babel-plugin/index.js.mcp.json.cursor/mcp.json.codex/config.toml.vscode/mcp.json.claude/settings.local.json~/.ceraph/auth.json.rn-errors.json.gitignore.ceraph/

Network endpoints4

ceraph.devceraph.dev/cli-auth<CERAPH_SIGNAL_HOST>:8101/signal<CERAPH_SIGNAL_HOST>:8101/commands

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js auto-starts an MCP server unless CERAPH_NO_AUTOSTART=1.
dist/index.js exposes ceraph_init_setup_mcp_clients to write .mcp.json, .cursor/mcp.json, .codex/config.toml, .vscode/mcp.json, and .claude/settings.local.json preapproval.
dist/index.js ceraph_init_auth_browser persists pasted/browser token to ~/.ceraph/auth.json.
dist/shim/command-poll.js polls http://<host>:8101/commands and can run reset/reload/hook/fiber commands in __DEV__ apps.
dist files are intentionally obfuscated, raising audit difficulty.

Evidence against

package.json postinstall only prints setup instructions and has no config mutation or network call.
README.md documents init, MCP client config writes, Claude hook setup, auth token storage, and uninstall behavior.
dist/shim/boot.js gates runtime instrumentation on __DEV__.
dist/babel-plugin/index.js only injects deterministic testID attributes when not production.
Network endpoints found are package-aligned Ceraph auth/pro features or local dev endpoints.
No evidence of credential harvesting, stealth persistence, destructive install-time behavior, or remote payload loading.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

MinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 1.12 MB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

package.jsonView file

Lines 108-130json

108 "tsup": "^8.5.0",

109 "tsx": "^4",

110 "typescript": "^5.7",

111 "vitest": "^3",

112 "@ceraph/graph": "0.1.0",

113 "@ceraph/core": "0.1.0"

114 },

115 "engines": {

116 "node": ">=18"

117 },

118 "publishConfig": {

119 "access": "public"

120 },

121 "license": "FSL-1.1-MIT",

122 "scripts": {

123 "build": "rm -rf dist && tsup && tsc -p tsconfig.shim.json",

124 "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.shim.json",

125 "test": "vitest run --passWithNoTests",

126 "check:catalog-key": "tsx scripts/check-catalog-key.ts",

127 "obfuscate": "tsx scripts/obfuscate.ts",

128 "postinstall": "node -e \"try{var e=process.env;if(e.CI||e.CERAPH_SKIP_POSTINSTALL||require('fs').existsSync(process.cwd()+'/../../pnpm-workspace.yaml'))process.exit(0);process.stderr.write('\\n[@ceraph/react-native-mcp] installed. To finish setup run: npx @ceraph/react-native-mcp init\\n (MCP config, sign-in, the runtime-error hook, and your Mac LAN IP. Build/run/device tools work without it.)\\n\\n')}catch(_){}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L128

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L128

129 }

130}

dist/index.jsView file

1#!/usr/bin/env node L2: const _0x2a5a1e=_0x3342;(function(_0x3162e2,_0x306c63){const _0x5af676=_0x3342,_0x15cf14=_0x3162e2();while(!![]){try{const _0x119f3e=parseInt(_0x5af676(0x594))/0x1*(-parseInt(_0x5a...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

dist/babel-plugin/index.cjsView file

Lines 1-1javascript

1'use strict';const _0x304ea9=_0x3295;(function(_0x59ca79,_0x6d07f7){const _0x48b525=_0x3295,_0x41ebe6=_0x59ca79();while(!![]){try{const _0x2f35a2=parseInt(_0x48b525(0xd8))/0x1

dist/babel-plugin/index.jsView file

Lines 1-1javascript

1const _0x2eb26f=_0x40e6;(function(_0x1515a4,_0x28e41c){const _0x30b84d=_0x40e6,_0x2a1e23=_0x1515a4();while(!![]){try{const _0x2a7c62=parseInt(_0x30b84d(0xfd))/0x1*(-

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{var e=process.env;if(e.CI||e.CERAPH_SKIP_POSTINSTALL||require('fs').existsSync(process.cwd()+'/../../pnpm-workspace.yaml'))process.exit(0);process.stderr.write('\n[@ce...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

dist/babel-plugin/index.cjsView file

1'use strict';const _0x304ea9=_0x3295;(function(_0x59ca79,_0x6d07f7){const _0x48b525=_0x3295,_0x41ebe6=_0x59ca79();while(!![]){try{const _0x2f35a2=parseInt(_0x48b525(0xd8))/0x1*(-pa...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/babel-plugin/index.cjsView on unpkg · L1

dist/babel-plugin/index.jsView file

1const _0x2eb26f=_0x40e6;(function(_0x1515a4,_0x28e41c){const _0x30b84d=_0x40e6,_0x2a1e23=_0x1515a4();while(!![]){try{const _0x2a7c62=parseInt(_0x30b84d(0xfd))/0x1*(-parseInt(_0x30b...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/babel-plugin/index.jsView on unpkg · L1

Findings

1 Critical5 High4 Medium3 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighObfuscated Payload Loaderdist/babel-plugin/index.js

HighObfuscated

MediumDynamic Requiredist/babel-plugin/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 108-130json

108 "tsup": "^8.5.0",

109 "tsx": "^4",

110 "typescript": "^5.7",

111 "vitest": "^3",

112 "@ceraph/graph": "0.1.0",

113 "@ceraph/core": "0.1.0"

114 },

115 "engines": {

116 "node": ">=18"

117 },

118 "publishConfig": {

119 "access": "public"

120 },

121 "license": "FSL-1.1-MIT",

122 "scripts": {

123 "build": "rm -rf dist && tsup && tsc -p tsconfig.shim.json",

124 "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.shim.json",

125 "test": "vitest run --passWithNoTests",

126 "check:catalog-key": "tsx scripts/check-catalog-key.ts",

127 "obfuscate": "tsx scripts/obfuscate.ts",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L128

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L128

129 }

130}

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

dist/babel-plugin/index.cjsView file

Lines 1-1javascript

1'use strict';const _0x304ea9=_0x3295;(function(_0x59ca79,_0x6d07f7){const _0x48b525=_0x3295,_0x41ebe6=_0x59ca79();while(!![]){try{const _0x2f35a2=parseInt(_0x48b525(0xd8))/0x1

dist/babel-plugin/index.jsView file

Lines 1-1javascript

1const _0x2eb26f=_0x40e6;(function(_0x1515a4,_0x28e41c){const _0x30b84d=_0x40e6,_0x2a1e23=_0x1515a4();while(!![]){try{const _0x2a7c62=parseInt(_0x30b84d(0xfd))/0x1*(-