registry / @codori/server / 0.6.0

@codori/server@0.6.0

Codori server for Git project discovery, Codex runtime management, and bundled dashboard serving.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a Codori server/CLI that starts a local Codex runtime and serves a bundled dashboard when explicitly run.

Static reason

No blocking static signals were detected.

Trigger

Explicit user command such as codori serve, start, install-service, or HTTP API calls to the running local server.

Impact

Project-root file access, git operations, attachments, and Codex runtime control are package-aligned capabilities exposed by the running server, not install-time compromise.

Mechanism

User-invoked local server, service registration, git/runtime management, and local dashboard serving.

Rationale

Source inspection shows powerful but package-aligned local server and Codex runtime management, activated by explicit user commands or HTTP requests after the server is running. There is no lifecycle execution, credential exfiltration, stealth persistence, or unconsented mutation of a foreign AI-agent control surface.

Evidence

package.jsondist/cli.jsdist/service.jsdist/service-adapters.jsdist/service-update.jsdist/process-manager.jsdist/http-server.jsdist/git.jsdist/local-file-viewer.jsdist/attachment-store.jsdist/config.jsdist/runtime-store.js~/.codori/config.json~/.codori/run/*.pid.json~/.codori/services/<installId>/service.json

@codori/server@0.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code