registry / @desplega.ai/agent-fs / 0.10.1
@desplega.ai/agent-fs@0.10.1
Agent-first filesystem backed by S3
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found powerful CLI capabilities, but they are documented, package-aligned, and activated by explicit commands rather than install/import-time execution. No hardcoded exfiltration endpoint, stealth persistence, destructive behavior, dependency confusion, or unconsented AI-agent control-surface mutation was confirmed.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit user CLI commands such as agent-fs onboard, server, mcp, mount, download, or file operations.
Impact
Can write package-owned config/database/storage, contact configured services, and spawn helper processes when requested; no stealth install-time mutation or credential exfiltration found.
Mechanism
User-invoked filesystem service, S3/local storage client, MCP server, and FUSE mount helper.
AI rationale
Static inspection found powerful CLI capabilities, but they are documented, package-aligned, and activated by explicit commands rather than install/import-time execution. No hardcoded exfiltration endpoint, stealth persistence, destructive behavior, dependency confusion, or unconsented AI-agent control-surface mutation was confirmed.
Evidence
package.jsonREADME.mddist/cli.jsdist/fuse-bin.manifest.json~/.agent-fs/config.json~/.agent-fs/agent-fs.db~/.agent-fs/storage~/.agent-fs/mount.pid~/.agent-fs/mount.log
Network endpoints6
localhost:9000127.0.0.1:7433live.agent-fs.devuser-configured AGENT_FS_API_URLuser-configured S3 endpointOpenAI/Gemini APIs via declared SDKs
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js is a large bundled CLI with network, env, filesystem, child_process, and FUSE helper capabilities.
- dist/cli.js reads/writes ~/.agent-fs/config.json, ~/.agent-fs/agent-fs.db, mount pid/log files, and optional local storage under user-selected paths.
- dist/cli.js can spawn Docker for MinIO during explicit onboard and spawn a package-owned FUSE helper during explicit mount.
- dist/cli.js reads API/S3/embedding keys from env or ~/.agent-fs config and passes remote mount API key to the helper env.
Evidence against
- package.json has only prepublishOnly; no preinstall/install/postinstall runtime hook.
- The only bin entry is agent-fs -> dist/cli.js, so behavior is activated by explicit CLI commands.
- Network endpoints are localhost defaults, user-configured S3/API URLs, or declared embedding/S3 SDK functionality; no hardcoded attacker exfiltration endpoint found.
- README.md describes the CLI, MCP, HTTP API, S3/local storage, and FUSE mount features matching observed code.
- FUSE helper resolution is constrained to first-party optional dependencies or explicit AGENT_FS_FUSE_BIN and verifies hashes from dist/fuse-bin.manifest.json when present.
Source & flagged code
6 flaggeddist/cli.jsView file
171ORDER BY distance
L172: LIMIT ?`).all(D,T),A=[],R=new Set;for(let L of U){let X=N.db.select().from(f.contentChunks).where(Z0(f.contentChunks.id,L.chunk_id)).get();if(!X||X.driveId!==N.driveId)continue;if(...
L173: ]))`;continue}else if(w[A]==="$"){$+=`($|(?=[\r
...
L175: `:`[${w[A]}\r
L176: ]`;continue}if($+=w[A],w[A]==="\\")D=!0;else if(_&&w[A]==="]")_=!1;else if(!_&&w[A]==="[")_=!0}try{new RegExp($)}catch{return console.warn(`Could not convert regex pattern at ${E.c...
L177: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}GD=new e6({name:"agent-fs",version:FN},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L1713var M1=Object.create;var{getPrototypeOf:C1,defineProperty:E$,getOwnPropertyNames:B1}=Object;var S1=Object.prototype.hasOwnProperty;function H1(N){return this[N]}var n1,O1,zN=(N,E,T...
L4: Install with: brew install sqlite`)}var CD=!1;var BD=Z(()=>{g1()});import{mkdirSync as q1,readFileSync as v1,writeFileSync as T$,existsSync as HD}from"fs";import{join as GT}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L144: ${GE.toHex(D)}`}getCanonicalPath({path:N}){if(this.uriEscapePath){let E=[];for(let $ of N.split("/")){if($?.length===0)continue;if($===".")continue;if($==="..")E.pop();else E.push(...
L145: `);return this.signString(J,{signingDate:T,signingRegion:_,signingService:D})}async signMessage(N,{signingDate:E=new Date,signingRegion:T,signingService:w}){return this.signEvent({...
L
Critical
Findings
3 Critical3 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.10.1.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.