@constellationdev/mcp@1.3.0
Codebase Understanding for AI Coding Agents
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package sends default-on runtime telemetry containing project and branch identifiers and tool usage details, without disclosing that reporting in its README. The opt-out makes this a suspicious telemetry finding rather than a malicious exfiltration finding.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After a successful code_intel execution with tool invocations, when usage tracking is enabled; tracking is enabled by default.
Impact
The service receives identifying project metadata and usage activity. The included README does not disclose this separate telemetry.
Mechanism
The package sends a JSON usage event containing project ID, branch name, invocation names, token counts, and timing data in a POST authenticated with the configured access key.
AI rationale
The package sends default-on runtime telemetry containing project and branch identifiers and tool usage details, without disclosing that reporting in its README. The opt-out makes this a suspicious telemetry finding rather than a malicious exfiltration finding.
Evidence
dist/index.jsREADME.md
Network endpoints1
api.constellationdev.io/intel/v1/usage (default; USAGE_ENDPOINT_URL can override the endpoint)
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Usage tracking defaults to enabled, with environment-variable opt-outs.
- After a successful code_intel execution, the package builds a usage event from project, branch, invocation, and timing data.
- The event includes the project ID, branch name, tool invocation names, token counts, and timing metrics.
- The package POSTs the event with the configured access key to its usage endpoint.
Evidence against
- The README describes the package as providing code intelligence without transmitting source code.
- The only lifecycle script is prepare: husky; no install or postinstall telemetry hook is declared.
- The runtime telemetry can be disabled with CONSTELLATION_USAGE_METRICS=false or USAGE_TRACKING_ENABLED=false.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @constellationdev/mcp@1.2.11
matchedIdentity = npm:QGNvbnN0ZWxsYXRpb25kZXYvbWNw:1.2.11
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import {serveStdio}from'@[redacted]';import {createRequire}from'module';import Y from'path';import {promises}from'fs';import {McpServer,ResourceTemplate,Reso...
L3:
High
1#!/usr/bin/env node
L2: import {serveStdio}from'@[redacted]';import {createRequire}from'module';import Y from'path';import {promises}from'fs';import {McpServer,ResourceTemplate,Reso...
L3:
...
L11:
L12: For more information, visit: ${T.root}`;return {config:this.applyEnvironmentOverrides(i),gitRoot:e,loadedAt:Date.now(),configLoaded:false,initializationError:a}}}applyEnvironmentOv...
L13:
High
Findings
1 Critical3 High3 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumUnsafe Vm Contextdist/sandbox-worker.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @constellationdev/mcp@1.3.0.
See all versions of @constellationdev/mcp for other recorded verdicts.
- Review the evidence and your use of @constellationdev/mcp@1.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.