@echomem/mcp@1.4.71
EchoMem MCP bridge for cross-agent memory, local history import, and recall
AI Security Review
scanned 6d ago · by lpm-firewall-aiThis is intentional runtime telemetry, but the package README does not disclose it, so it warrants a warning. The inspected events contain usage and installation identifiers rather than credentials, file contents, or other sensitive machine data.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs CLI setup, connect, or login flows, or advances through onboarding.
Impact
The vendor’s analytics service can associate product usage with an installation and, after sign-in, an Echo account. No credentials or file contents were observed in the analytics payloads inspected.
Mechanism
The package posts analytics events to https://us.i.posthog.com/i/v0/e/ with command, platform, version, installation identity, and some onboarding usage fields.
AI rationale
This is intentional runtime telemetry, but the package README does not disclose it, so it warrants a warning. The inspected events contain usage and installation identifiers rather than credentials, file contents, or other sensitive machine data.
Evidence
dist/product-analytics.jsdist/setup.js~/.echomem/installation-id~/.echomem/analytics-anon-id~/.echomem/analytics-user-idECHO_CONFIG_DIR/installation-idECHO_CONFIG_DIR/analytics-anon-idECHO_CONFIG_DIR/analytics-user-id
Network endpoints1
us.i.posthog.com/i/v0/e/
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package sends CLI and onboarding funnel analytics to PostHog when users run setup or login flows; the package README does not disclose this telemetry.
- Events include the command and may include configured host IDs and import session counts, in addition to platform and version data.
- The analytics code uses a random installation ID and, after sign-in, an Echo account ID; the inspected fields do not include credentials or file contents.
- Users can disable telemetry with ECHO_TELEMETRY, ECHO_DISABLE_TELEMETRY, or DO_NOT_TRACK.
Evidence against
- No install lifecycle scripts are declared; analytics runs during CLI commands and onboarding flows.
- The setup API defaults to EchoMem’s API, and the bearer token is sent to that configured API endpoint.
- The telemetry code filters sensitive fields and normalizes errors before sending them.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggeddist/durable-entry.jsView file
1import { spawnSync } from "node:child_process";
L2: import fs from "node:fs";
High
Child Process
Package source references child process execution.
dist/durable-entry.jsView on unpkg · L1dist/setup.jsView file
730};
L731: const result = spawnSync(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${shellCommand}"`], spawnOptions);
L732: if (result.error)
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/setup.js:
import readline from "node:readline";
return configuredProfileDirectory("CODEX_HOME", ".codex");
return configuredProfileDirectory("CLAUDE_CONFIG_DIR", ".claude");
if (env.CLAUDE_DESKTOP_SUPPORT_DIR?.trim())
...claudeDesktopClients,
{ id: "codex", label: "Codex", kind: "command", detectDir: codexHome(), configPath: path.join(codexHome(), "config.toml"), note: "add to ~/.codex/config.toml under [mcp_servers.ech...
* can merge the user entry into ~/.claude.json without a CLI, a profile is enough to act on.
return fs.existsSync(home(".claude")) || fs.existsSync(home(".claude.json")) || claudeCodeCliAvailable();
Findings
6 High3 Medium5 Low
HighChild Processdist/durable-entry.js
HighShelldist/setup.js
HighSame File Env Network Executiondist/hud/server.js
HighCredential Redirect Persistencedist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/hud/hooks.js
HighPrevious Version Dangerous Deltadist/setup.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/hud/autostart.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @echomem/mcp@1.4.71.
See all versions of @echomem/mcp for other recorded verdicts.
- Review the evidence and your use of @echomem/mcp@1.4.71 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.