@compr/opscontext-mcp@2.14.0
OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package has no npm install lifecycle trigger, but an explicit CLI setup command registers executable hooks in Claude settings, a guarded agent configuration capability. The source reviewed did not establish an attack, so this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the install-claude-hook CLI command.
Impact
Claude Code may run the package’s configured hook commands during later use, and optional autostart setup creates a user launch agent.
Mechanism
The installer adds command hooks to Claude settings and writes the updated settings file; autostart is a separate explicit CLI setup command.
AI rationale
The package has no npm install lifecycle trigger, but an explicit CLI setup command registers executable hooks in Claude settings, a guarded agent configuration capability. The source reviewed did not establish an attack, so this warrants a warning rather than a block.
Evidence
dist/cli.jsdist/install-claude-hook.jsdist/install-autostart.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json lists only prepublishOnly as a lifecycle script; installation does not automatically run the inspected setup code.
- The CLI exposes a dedicated install-claude-hook command that calls its installer.
- The Claude hook installer registers command hooks in Claude settings and writes the modified settings file.
- The package also offers an explicit autostart setup path that creates a launch-agent plist.
- Agent-related code reads project configuration, installs a package-owned skill, and reads managed settings; the inspected target locations do not show credential exfiltration.
Evidence against
- The hooks and autostart are reached through explicit CLI commands, not an npm install lifecycle hook.
- The inspected activation code sends license activation to the package’s configured activation service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flagged · loading sourcedist/adapters.jsView file
47}
L48: const mod = await import(moduleSpecifier);
L49: // Check for factory function
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/adapters.jsView on unpkg · L47dist/install-autostart.jsView file
13Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/install-autostart.js
L13: // forever — defeating the whole point.
L14: // FIX: To add platform support beyond macOS, branch on process.platform and
L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive
...
L19: import { homedir, platform } from "os";
L20: import { execFileSync } from "child_process";
L21: import { createRequire } from "module";
...
L34: const __filename_esm = fileURLToPath(import.meta.url);
L35: const __dirname_esm = dirname(__filename_esm);
L36: const requireFromHere = createRequire(import.meta.url);
...
L102: // [LOCKED] [AUTOSTART-ARGV-AND-XML-ESCAPED] - 2026-09-25
L103: // [NEVER] paste a path into a launchctl/lsof/curl command string, or into the plist unescaped.
L104:
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/install-autostart.jsView on unpkg · L13Findings
4 High6 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-claude-hook.js
HighTrigger Reachable Persistencedist/install-autostart.js
HighSemantic Analysis Limiteddist/activation.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/cli.js
MediumDynamic Requiredist/adapters.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/install-autostart.js
MediumShips Build Helperdefaults/claude-code-hook.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @compr/opscontext-mcp@2.14.0.
See all versions of @compr/opscontext-mcp for other recorded verdicts.
- Review the evidence and your use of @compr/opscontext-mcp@2.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.