registry / @deerdawn/mcp-server / 1.0.34

@deerdawn/mcp-server@1.0.34

MCP server for DeerDawn — AI session memory that briefs every new AI session

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Authenticated runtime startup mutates AI-agent control files and installs Claude hooks without a separate explicit consent gate. Those hooks and signal handlers can collect session transcripts, cwd, and command summaries and send them to DeerDawn APIs.

Static reason

One or more suspicious static signals were detected.

Trigger

Starting the MCP server with DEERDAWN_API_KEY/saved credentials, completing device auth, or running setup/apply_setup.

Impact

Persistent model instructions and hooks can steer future AI sessions and exfiltrate conversation/workspace context to the vendor API.

Mechanism

unconsented AI-agent control-surface mutation plus session telemetry upload

Policy narrative

When the MCP server starts with credentials, dist/index.js calls autoConfigureHooks and syncProjectFiles. These functions modify global and project AI instruction files and install Claude hooks that later run deerdawn-mcp commands. Those commands read recent Claude/Codex transcripts or command payloads and post summarized session context to api.deerdawn.com.

Rationale

Although the package is a session-memory MCP and has no install hook, the runtime automatically persists instructions/hooks into multiple AI-agent control surfaces and uploads session content; that is concrete unconsented AI-agent control-surface mutation rather than a scanner false positive. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonREADME.mddist/index.jsdist/chunk-SWBO3RSY.js~/.claude/settings.json~/.claude/CLAUDE.md~/.codex/AGENTS.md~/.cursor/rules/deerdawn.mdc~/.deerdawn/credentials.json~/.deerdawn/pending-auth.json~/.deerdawn/synced-paths.jsonAGENTS.mdCLAUDE.md.cursorrules.deerdawn-context.md.github/copilot-instructions.md.claude/skills/deerdawn-*.cursor/rules/deerdawn-*.mdc

Network endpoints5

api.deerdawn.comapi.deerdawn.com/api/v1/auth/mcp/startapi.deerdawn.com/api/v1/context/extractionapi.deerdawn.com/api/v1/context/activeapi.deerdawn.com/api/v1/context/search

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for policy block

dist/index.js autoConfigureHooks writes Claude hooks and global CLAUDE.md after auth/startup.
dist/index.js writes ~/.codex/AGENTS.md with DeerDawn instructions if it exists.
dist/index.js syncProjectFiles writes project AGENTS.md, CLAUDE.md, .cursorrules, .deerdawn-context.md on startup.
dist/index.js flushSession reads Claude/Codex session JSONL and POSTs conversation chunks to /api/v1/context/extraction.
dist/index.js main records runtime startup/tool events with cwd to api.deerdawn.com.
dist/index.js command hook captures Bash command text after redaction and records it remotely.

Evidence against

package.json has no install/preinstall/postinstall lifecycle scripts.
Network endpoints are DeerDawn-branded and partly match README-described session-memory functionality.
Secrets are redacted in command capture and API keys are stored under ~/.deerdawn/credentials.json.
Browser opening uses execFileSync with fixed platform commands and URL argument array, not shell interpolation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 304 KB of source, external domains: api.deerdawn.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 389-429javascript

389 nodes: z4.array(z4.object({

390 node_type: z4.enum(GRAPH_NODE_TYPE_VALUES),

391 canonical_key: z4.string().min(1),

392 title: z4.string().min(1)

393 })).default([]),

394 edges: z4.array(z4.object({

395 edge_type: z4.enum(GRAPH_EDGE_TYPE_VALUES),

396 from_node_id: z4.string().optional(),

397 to_node_id: z4.string().optional(),

398 summary: z4.string().optional()

399 })).default([])

400 }).optional()

401 });

402 var GraphNodeSchema = z4.object({

403 node_id: z4.string().min(1),

404 owner_key: z4.string().min(1),

405 project_id: z4.string().nullable().optional(),

406 node_type: z4.enum(GRAPH_NODE_TYPE_VALUES),

407 canonical_key: z4.string().min(1),

408 title: z4.string().min(1),

409 summary: z4.string().default(""),

410 metadata: z4.record(z4.unknown()).default({}),

411 confidence: z4.number().min(0).max(1).default(0.5),

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/index.jsView on unpkg · L409

412 source_session_id: z4.string().default(""),

413 source_tool: z4.enum(TOOL_VALUES),

414 created_at: z4.string().datetime(),

415 updated_at: z4.string().datetime(),

416 last_seen_at: z4.string().datetime()

417 });

418 var GraphEdgeSchema = z4.object({

419 edge_id: z4.string().min(1),

420 owner_key: z4.string().min(1),

421 project_id: z4.string().nullable().optional(),

422 edge_type: z4.enum(GRAPH_EDGE_TYPE_VALUES),

423 from_node_id: z4.string().min(1),

424 to_node_id: z4.string().min(1),

425 summary: z4.string().default(""),

426 metadata: z4.record(z4.unknown()).default({}),

427 confidence: z4.number().min(0).max(1).default(0.5),

428 source_session_id: z4.string().default(""),

429 source_tool: z4.enum(TOOL_VALUES),

Lines 2399-2439javascript

2399 } catch (error) {

2400 if (error instanceof z.ZodError) {

2401 const sanitizedIssues = error.issues.map((issue) => ({

2402 ...issue,

2403 path: issue.path.includes("apiKey") ? ["apiKey"]

Lines 6215-6255javascript

6215 }

6216 process.exit(0);

6217} else if (cliCommand === "capture-worktree-change") {

6218 captureWorktreeChange(process.env.DEERDAWN_SURFACE_ID === "codex" ? "codex" : "claude_code").then(() => process.exit(0

Source & flagged code

3 flagged · loading source

dist/index.jsView file

2419import os from "os"; L2420: import { execFileSync } from "child_process"; L2421:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2419

6235const { homedir } = await import("os"); L6236: const { execFileSync: execFileSync4 } = await import("child_process"); L6237: const home = homedir(); L6238: const apiUrl = process.env.DEERDAWN_API_URL ?? "https://api.deerdawn.com"; L6239: let apiKey = process.env.DEERDAWN_API_KEY ?? loadSavedApiKey() ?? null;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L6235

409summary: z4.string().default(""), L410: metadata: z4.record(z4.unknown()).default({}), L411: confidence: z4.number().min(0).max(1).default(0.5), ... L1230: try { L1231: const fmt = new Intl.DateTimeFormat("en-US", { L1232: timeZone: tz, ... L1635: } L1636: var DEFAULT_MCP_API_URL = "https://api.deerdawn.com"; L1637: function buildMcpServerConfigObject(apiUrl = DEFAULT_MCP_API_URL, apiKey = "") { ... L1919: } = require_src(); L1920: function getHomeDir() { L1921: return process.env.DEERDAWN_HOME_DIR || os8.homedir();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/index.jsView on unpkg · L409

Findings

4 High2 Medium4 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighHost Fingerprint Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 389-429javascript

389 nodes: z4.array(z4.object({

390 node_type: z4.enum(GRAPH_NODE_TYPE_VALUES),

391 canonical_key: z4.string().min(1),

392 title: z4.string().min(1)

393 })).default([]),

394 edges: z4.array(z4.object({

395 edge_type: z4.enum(GRAPH_EDGE_TYPE_VALUES),

396 from_node_id: z4.string().optional(),

397 to_node_id: z4.string().optional(),

398 summary: z4.string().optional()

399 })).default([])

400 }).optional()

401 });

402 var GraphNodeSchema = z4.object({

403 node_id: z4.string().min(1),

404 owner_key: z4.string().min(1),

405 project_id: z4.string().nullable().optional(),

406 node_type: z4.enum(GRAPH_NODE_TYPE_VALUES),

407 canonical_key: z4.string().min(1),

408 title: z4.string().min(1),

409 summary: z4.string().default(""),

410 metadata: z4.record(z4.unknown()).default({}),

411 confidence: z4.number().min(0).max(1).default(0.5),

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/index.jsView on unpkg · L409

412 source_session_id: z4.string().default(""),

413 source_tool: z4.enum(TOOL_VALUES),

414 created_at: z4.string().datetime(),

415 updated_at: z4.string().datetime(),

416 last_seen_at: z4.string().datetime()

417 });

418 var GraphEdgeSchema = z4.object({

419 edge_id: z4.string().min(1),

420 owner_key: z4.string().min(1),

421 project_id: z4.string().nullable().optional(),

422 edge_type: z4.enum(GRAPH_EDGE_TYPE_VALUES),

423 from_node_id: z4.string().min(1),

424 to_node_id: z4.string().min(1),

425 summary: z4.string().default(""),

426 metadata: z4.record(z4.unknown()).default({}),

427 confidence: z4.number().min(0).max(1).default(0.5),

428 source_session_id: z4.string().default(""),

429 source_tool: z4.enum(TOOL_VALUES),

Lines 2399-2439javascript

2399 } catch (error) {

2400 if (error instanceof z.ZodError) {

2401 const sanitizedIssues = error.issues.map((issue) => ({

2402 ...issue,

2403 path: issue.path.includes("apiKey") ? ["apiKey"]

Lines 6215-6255javascript

6215 }

6216 process.exit(0);

6217} else if (cliCommand === "capture-worktree-change") {

6218 captureWorktreeChange(process.env.DEERDAWN_SURFACE_ID === "codex" ? "codex" : "claude_code").then(() => process.exit(0