@echomem/mcp@1.4.62
EchoMem MCP bridge for cross-agent memory, local history import, and recall
AI Security Review
scanned 19d ago · by lpm-firewall-aiSaved EchoMem tokens are sent to environment-configurable endpoints without a host allowlist, which creates conditional credential exposure. The default endpoints are package-aligned and the override appears intended for alternate EchoMem services, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs onboarding, unlock, status, migration, a connected MCP operation, HUD action, usage sync, or a configured session hook while an alternate endpoint is set.
Impact
The configured recipient can receive an existing EchoMem account token. The inspected source does not establish actual misuse or a package-selected unrelated default recipient.
Mechanism
Runtime clients read saved tokens and attach them as bearer credentials to requests using ECHO_API_BASE_URL or ECHO_PRICING_URL. The source does not bind those credentials to an allowed host.
AI rationale
Saved EchoMem tokens are sent to environment-configurable endpoints without a host allowlist, which creates conditional credential exposure. The default endpoints are package-aligned and the override appears intended for alternate EchoMem services, so this warrants a warning rather than a malicious verdict.
Evidence
dist/setup.jsdist/index.jsdist/migrate.jsdist/codex-sync.jsdist/hud/diagnostics.jsdist/hud/server.jsdist/source-session-hook.js
Network endpoints2
echo-mem-chrome.vercel.appechoknows.com/account
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The API and pricing endpoints can be changed through environment variables, and authenticated clients attach a bearer token to requests at those bases.
- Onboarding, unlock, status, migration, MCP, HUD, diagnostics, usage-sync, and session-hook paths reuse a stored token in requests to the configurable API base.
- Billing requests also send a bearer token to the configurable pricing endpoint.
- The agent-integration locations show local session discovery, index reading, and profile-scoped hook setup; they do not establish broad agent-control mutation.
- The source describes local or older EchoMem API use for the API override, while the default endpoints are EchoMem services.
Evidence against
- The potential exposure depends on an operator-configured endpoint; the inspected defaults point to EchoMem services.
- The package manifest has no install-time lifecycle hook, so the credential behavior is reached through runtime commands and requests.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
8 flaggeddist/durable-entry.jsView file
1import { spawnSync } from "node:child_process";
L2: import fs from "node:fs";
High
Child Process
Package source references child process execution.
dist/durable-entry.jsView on unpkg · L1dist/setup.jsView file
703};
L704: const result = spawnSync(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${shellCommand}"`], spawnOptions);
L705: if (result.error)
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/setup.js:
import readline from "node:readline";
return configuredProfileDirectory("CODEX_HOME", ".codex");
return configuredProfileDirectory("CLAUDE_CONFIG_DIR", ".claude");
if (env.CLAUDE_DESKTOP_SUPPORT_DIR?.trim())
...claudeDesktopClients,
{ id: "codex", label: "Codex", kind: "command", detectDir: codexHome(), configPath: path.join(codexHome(), "config.toml"), note: "add to ~/.codex/config.toml under [mcp_servers.ech...
* can merge the user entry into ~/.claude.json without a CLI, a profile is enough to act on.
return fs.existsSync(home(".claude")) || fs.existsSync(home(".claude.json")) || claudeCodeCliAvailable();
Findings
7 High3 Medium5 Low
HighChild Processdist/durable-entry.js
HighShelldist/setup.js
HighSame File Env Network Executiondist/hud/server.js
HighCredential Redirect Persistencedist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/hud/hooks.js
HighSemantic Analysis Limiteddist/headless-runtime.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/setup.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @echomem/mcp@1.4.62.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.62 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.