registry / @echomem/mcp / 1.4.26
@echomem/mcp@1.4.26
EchoMem MCP bridge: cloud-first memory tools, local context HUD, and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/forensics.jsView file
19import path from "node:path";
L20: import { execFileSync } from "node:child_process";
L21: import { calculateContextMetrics } from "./context-metrics/calculate.js";
High
dist/hud/autostart.jsView file
3import path from "node:path";
L4: import { spawnSync } from "node:child_process";
L5: // Show-after-restart for the HUD via a macOS LaunchAgent. We ship a CLI, not an .app bundle, so this is
...
L9: export function autostartPlistPath() {
L10: return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L11: }
L12: export function autostartSupported() {
L13: return process.platform === "darwin";
L14: }
...
L20: }
L21: function launchctlUid() {
L22: return typeof process.getuid === "function" ? process.getuid() : 501;
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/hud/autostart.jsView on unpkg · L3Findings
4 High5 Medium5 Low
HighChild Processdist/forensics.js
HighShell
HighSame File Env Network Executiondist/hud/server.js
HighPrevious Version Dangerous Deltadist/setup.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
MediumShips Wasm Moduledist/city/vendor/rive.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @echomem/mcp@1.4.26.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.