registry / @claude-view/plugin / 0.45.0

@claude-view/plugin@0.45.0

Claude Code plugin for claude-view — auto-starts web dashboard, provides session/cost/fluency tools and skills

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A Claude Code SessionStart hook automatically launches the first-party claude-view dashboard through npx. The packaged MCP server proxies tools only to a localhost dashboard API; no confirmed exfiltration path exists in this package.

Static reason

No blocking static signals were detected.

Trigger

Claude Code plugin session start; explicit MCP tool invocation.

Impact

Adds a persistent-per-session local process and agent capabilities, including dashboard-mediated plugin operations.

Mechanism

first-party agent hook starts a local dashboard and exposes localhost-backed MCP tools

Rationale

The package has no npm install-time hook and its own network client is localhost-only. Its automatic SessionStart launcher warrants a warning as first-party agent extension lifecycle behavior, not a malicious block.

Evidence

package.jsonhooks/hooks.jsonhooks/start-server.sh.mcp.jsondist/client.jsdist/tools/generated/plugins.js

Network endpoints2

localhost:${PORT}/api/healthlocalhost:${resolvedPort}

Decision evidence

public snapshot

@claude-view/plugin@0.45.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code