@echomem/mcp@1.4.42
EchoMem MCP bridge: cloud-first memory tools and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource confirms a persistent, behavior-bearing AI-agent integration with coercive default-memory guidance. Its explicit CLI trigger and absence of install lifecycle hooks make this a warning rather than a publish-blocking malicious package.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `echomem-mcp init`, `setup`, or `update` without opt-out flags.
Impact
Future agent sessions may execute EchoMem commands and be directed to save/search memories, affecting user-agent behavior beyond the invoking command.
Mechanism
Global AI-agent instruction and lifecycle-hook installation.
AI rationale
Source confirms a persistent, behavior-bearing AI-agent integration with coercive default-memory guidance. Its explicit CLI trigger and absence of install lifecycle hooks make this a warning rather than a publish-blocking malicious package.
Evidence
package.jsondist/index.jsdist/setup.jsdist/hud/hooks.jsdist/headless-runtime.js~/.codex/AGENTS.md~/.claude/CLAUDE.md~/.codex/hooks.json~/.claude/settings.json~/.codex/skills/echomem-search~/.echomem/mcp-runtime
Network endpoints2
echo-mem-chrome.vercel.appechoknows.com/memory
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `setup` writes global agent guidance selecting EchoMem as the default memory provider and requiring saves without a separate request.
- The default `setup` path installs that guidance, bundled skills, and lifecycle hooks.
- Installed Codex hooks execute package commands on SessionStart and Stop.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The mutations are reached through explicit `init`/`setup` CLI subcommands, not package installation.
- The source scopes its config edits to EchoMem-owned entries and supports opt-out flags.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
10 flaggeddist/forensics.jsView file
19import path from "node:path";
L20: import { execFileSync } from "node:child_process";
L21: import { calculateContextMetrics } from "./context-metrics/calculate.js";
High
dist/headless-runtime.jsView file
65'if (!fs.existsSync(entry)) throw new Error("EchoMem MCP runtime is missing; run `npx -y @echomem/mcp@latest update --all`.");',
L66: "await import(pathToFileURL(entry).href);",
L67: "",
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/headless-runtime.jsView on unpkg · L65dist/hud/autostart.jsView file
Findings
8 High6 Medium5 Low
HighChild Processdist/forensics.js
HighShell
HighSame File Env Network Executiondist/hud/server.js
HighCredential Redirect Persistencedist/setup.js
HighEntrypoint Foreign Package Code Overwritedist/setup.js
HighExternal Ai Agent Control Surface Mutationdist/hud/hooks.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/hud/hooks.js
HighPrevious Version Dangerous Deltadist/setup.js
MediumDynamic Requiredist/headless-runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
MediumShips Wasm Module
Affected versions and remediation
This report applies to @echomem/mcp@1.4.42.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.42 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.