registry / @echomem/mcp / 1.4.2
@echomem/mcp@1.4.2
EchoMem Cloud-First MCP Server
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
2 flaggeddist/hud/hooks.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
export function installhooks(mode) {
const written = [];
if (mode === "codex" || mode === "both" || mode === "auto") {
written.push(installcodexhooks());
}
if (mode === "claude-code" || mode === "both" || mode === "auto") {
written.push(installclaudecodesnippet());
}
return written;
}
function installcodexhooks() {
const dir = path.join(os.homedir(), ".codex");
const file = path.join(dir, "hooks.json");
fs.mkdirsync(dir, { recursive: true });
const hookcommand = `${json.stringify(process.execpath)} ${json.stringify(process.argv[1])} summary --client codex --json`;
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hud/hooks.jsView on unpkgdist/city/vendor/rive.wasmView file
•path = dist/city/vendor/rive.wasm
kind = wasm_module
sizeBytes = 1740592
magicHex = [redacted]
Medium
Findings
1 High4 Medium5 Low
HighExternal Ai Agent Control Surface Mutationdist/hud/hooks.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/city/vendor/rive.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @echomem/mcp@1.4.2.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.