registry / AI-agent control-surface risk / @codeatlas/mcp

@codeatlas/mcp

CodeAtlas MCP server — 57 tools + 8 resources that expose live codebase architecture (routes, sequences, diffs, impact analysis, architecture violations, read-only SQL access) and AI-driven code review (per-entry-point review, evidence-gated findings, cus

This report shows the evidence for @codeatlas/mcp@5.3.0. 2 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Direct source inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces and OS persistence. This meets the install-control-surface policy for blocking.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during a local install where INIT_CWD appears to be a workspace

Impact

Foreign AI clients are configured to launch the package server, and the server persists across user sessions.

Mechanism

unconsented AI-client auto-configuration plus OS daemon persistence

Policy narrative

The postinstall hook detects a repository from INIT_CWD, adds a CodeAtlas MCP entry to existing third-party AI-client configs, then creates and starts a per-user LaunchAgent, systemd service, or scheduled task. The persistent job launches dist/mcp-server.js for the workspace in browser mode. This occurs during npm installation without an explicit setup command or consent prompt.

AI rationale

Direct source inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces and OS persistence. This meets the install-control-surface policy for blocking.

Evidence

package.jsonscripts/preinstall.jsdist/postinstall-hint.jsdist/mcp-server.js~/.cursor/mcp.json~/.claude/settings.json~/.codex/config.json~/.config/systemd/user/codeatlas-mcp-<hash>.service

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs dist/postinstall-hint.js on install.
postinstall auto-writes detected Claude, Cursor, Codex, VS Code, Continue, and Gemini MCP configs.
postinstall creates and starts a LaunchAgent, systemd user service, or Windows logon task.
The persisted service launches dist/mcp-server.js with the installed workspace path and browser mode.
Writes occur automatically when INIT_CWD looks like a repository; no affirmative setup command is required.

Evidence against

scripts/preinstall.js only rejects global installs.
Postinstall suppresses itself in CI, silent mode, or CODEATLAS_NO_POSTINSTALL=1.
No install-time network endpoint or credential exfiltration was found in the inspected lifecycle sources.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

19 flagged

package.jsonView file

Lines 57-81json

57 "bin": {

58 "codeatlas-mcp": "./dist/mcp-server.js"

59 },

60 "files": [

61 "dist/mcp-server.js",

62 "dist/postinstall-hint.js",

63 "dist/sql-wasm.wasm",

64 "dist/tree-sitter.wasm",

65 "dist/grammars/**",

66 "dist/webview-ui/**",

67 "scripts/preinstall.js",

68 "README.md",

69 "LICENSE.md"

70 ],

71 "engines": {

72 "node": ">=18"

73 },

74 "scripts": {

75 "build": "node ../scripts/build-mcp-package.js",

76 "prepare": "npm run build",

77 "preinstall": "node ./scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "postinstall": "node ./dist/postinstall-hint.js"

79 }

80}

dist/webview-ui/dist/assets/index2.jsView file

Lines 1-29javascript

1import{r as xe}from"./index.js";const k=typeof __SENTRY_DEBUG__>"u"||__SENTRY_DEBUG__,$=globalThis,nn="10.56.0";function Gt(){return

dist/mcp-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codeatlas/mcp@5.0.0 matchedIdentity = npm:QGNvZGVhdGxhcy9tY3A:5.0.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp-server.jsView on unpkg

80`))if(u.startsWith("SF:"))r=u.slice(3).trim(),r.startsWith(t)&&(r=r.slice(t.length+1)),s=0,o=0,a=0,c=0;else if(u.startsWith("FN:")){let d=u.slice(3).split(",");d[1]&&(l[d[1]]={hits... L81: `));if(!v){v=null;break e}x=Array(qt(v)+1),v=Cn(v,x,0,x.length),x.length=v,St=x}v=St.shift()}return v},ub(v,x){x===null||x===10?(A(mt(v.output)),v.output=[]):x!=0&&v.output.push(x)... L82: PRAGMA foreign_keys = ON;

High

Child Process

Package source references child process execution.

dist/mcp-server.jsView on unpkg · L80

77})(${wke(this.node)}) L78: `;return this.replaceWith(u)[0].get("arguments.0")}function gsn(e){let t=e.params.findIndex(n=>Hin(n)||Win(n));return t===-1?e.params.length:t}});var Mke=T(Ti=>{"use strict";Object... L79: ON CONFLICT(snapshot_kind, graph_id) DO UPDATE SET graph_json = excluded.graph_json`,[this.kind,t,JSON.stringify(n)]);this.dirty.clear()}forgetBodies(){this.cache.clear(),this.lru.... L80: `))if(u.startsWith("SF:"))r=u.slice(3).trim(),r.startsWith(t)&&(r=r.slice(t.length+1)),s=0,o=0,a=0,c=0;else if(u.startsWith("FN:")){let d=u.slice(3).split(",");d[1]&&(l[d[1]]={hits... L81: `));if(!v){v=null;break e}x=Array(qt(v)+1),v=Cn(v,x,0,x.length),x.length=v,St=x}v=St.shift()}return v},ub(v,x){x===null||x===10?(A(mt(v.output)),v.output=[]):x!=0&&v.output.push(x)...

dist/postinstall-hint.jsView file

1"use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L29: </plist> L30: `}function ot(t){let e=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.length>0?process.env.XDG_CONFIG_HOME:m.join(R.homedir(),".config");return m.join(e,"systemd","user",... L31: Description=CodeAtlas MCP \u2014 workspace ${t.workspacePath} ... L44: WantedBy=default.target L45: `}function it(t){return`CodeAtlas MCP ${t}`}function at(t){return m.join(j(),`${t}.task.xml`)}function _t(t){let e=at(t.id);F(m.dirname(e)),g.writeFileSync(e,Wt(t),"utf-8");let n=[... L46: <Tas

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/postinstall-hint.jsView on unpkg · L1

1Trigger-reachable persistence chain: scripts.postinstall -> dist/postinstall-hint.js L1: "use strict";var Ct=Object.create;var L=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var Dt=Object.getPrototypeOf,bt=Object.protot... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L80: </Task> L81: `}function j(){return m.join(R.homedir(),".config","codeatlas","logs")}function Ht(t){F(j())}function F(t){g.mkdirSync(t,{recursive:!0})}function f(t){return t.replace(/&/g,"&"... L82: `;return yt(t.configPath,i),{client:t,status:p,backupPath:r,effectiveEntry:e}}function Gt(t,e){ht(t.configDir);let n="";if(t.configFileExists)try{n=u.readFileSync(t.configPath,"utf... L83: `;return yt(t.config

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/postinstall-hint.js

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./scripts/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/webview-ui/dist/assets/index2.jsView file

9patternName = generic_password severity = medium line = 9 matchedText = `)}`)}fu...ent.

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/webview-ui/dist/assets/index2.jsView on unpkg · L9

Findings

2 Critical10 High8 Medium8 Low

CriticalAi Agent Control Hijackdist/postinstall-hint.js

CriticalPrevious Version Dangerous Deltadist/mcp-server.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/mcp-server.js

HighSame File Env Network Executiondist/mcp-server.js

HighCommand Output Exfiltrationdist/mcp-server.js

HighObfuscated Payload Loaderdist/mcp-server.js

HighCross File Remote Execution Contextdist/mcp-server.js

HighTrigger Reachable Persistencedist/postinstall-hint.js

HighSemantic Analysis Limiteddist/mcp-server.js

HighKnown Malware Source Similaritydist/postinstall-hint.js

Affected versions and remediation

This report applies to @codeatlas/mcp@5.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @codeatlas/mcp@5.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-09 20:02:38.429Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

5.3.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 9, 2026, 8:00 PM 5.0.0Suspicious—WarnPublishedJul 14, 2026, 7:50 PM 4.0.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJun 30, 2026, 9:07 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code