@echomem/mcp@1.4.18
EchoMem MCP bridge: cloud-first memory tools, local context HUD, and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms meaningful AI-agent control-surface mutation and persistence, but all are explicit CLI features and there are no npm lifecycle hooks or covert payload execution. Warn rather than block under the explicit-user-command policy.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run echomem-mcp setup/init, echomem-hud install-hooks/autostart on, or migration/sync commands.
Impact
The package can influence configured agents to use EchoMem and persist a HUD; migration/sync can send selected local session data to its service.
Mechanism
Explicit CLI-driven agent configuration, persistence, and selected-history upload.
AI rationale
Source inspection confirms meaningful AI-agent control-surface mutation and persistence, but all are explicit CLI features and there are no npm lifecycle hooks or covert payload execution. Warn rather than block under the explicit-user-command policy.
Evidence
package.jsondist/setup.jsdist/hud/hooks.jsdist/hud/autostart.jsdist/hud/cli.jsdist/migrate.jsdist/codex-sync.jsdist/keystore.js~/.codex/config.toml~/.codex/AGENTS.md~/.codex/hooks.json~/.claude/CLAUDE.md~/.echomem/credentials.json~/Library/LaunchAgents/com.echomem.hud.plist
Network endpoints2
echo-mem-chrome.vercel.appregistry.npmjs.org/%40echomem%2Fmcp/latest
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/setup.js: setup/init writes MCP entries into detected client configs and global Codex/Claude guidance.
- dist/setup.js: default setup adds guidance telling agents to search/save EchoMem and run its HUD commands.
- dist/hud/hooks.js: explicit hook installation writes ~/.codex/hooks.json command hooks.
- dist/hud/autostart.js: explicit HUD command creates a macOS LaunchAgent.
- dist/migrate.js and dist/codex-sync.js upload selected local-session-derived data to EchoMem API.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Config, guidance, hooks, migration, and autostart are reached through named user CLI commands.
- Hook and autostart paths execute package-local binaries rather than downloaded payloads.
- No eval/vm/Function or covert remote-code-loading path found in reviewed entrypoints.
- Main MCP API traffic is package-aligned and uses the locally stored EchoMem token.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
7 flaggeddist/forensics.jsView file
19import path from "node:path";
L20: import { execFileSync } from "node:child_process";
L21: import { calculateContextMetrics } from "./context-metrics/calculate.js";
High
dist/hud/autostart.jsView file
3Trigger-reachable persistence chain: manifest.bin -> dist/hud/cli.js -> dist/hud/autostart.js
L3: import path from "node:path";
L4: import { spawnSync } from "node:child_process";
L5: // Show-after-restart for the HUD via a macOS LaunchAgent. We ship a CLI, not an .app bundle, so this is
...
L9: export function autostartPlistPath() {
L10: return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L11: }
L12: export function autostartSupported() {
L13: return process.platform === "darwin";
L14: }
...
L20: }
L21: function launchctlUid() {
L22: return typeof process.getuid === "function" ? process.getuid() : 501;
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/hud/autostart.jsView on unpkg · L3Findings
6 High5 Medium5 Low
HighChild Processdist/forensics.js
HighShell
HighSame File Env Network Executiondist/hud/server.js
HighExternal Ai Agent Control Surface Mutationdist/hud/hooks.js
HighTrigger Reachable Persistencedist/hud/autostart.js
HighPrevious Version Dangerous Deltadist/setup.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
MediumShips Wasm Moduledist/city/vendor/rive.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @echomem/mcp@1.4.18.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.