registry / @elixium.ai/mcp-server / 0.15.0

@elixium.ai/mcp-server@0.15.0

MCP Server for Elixium.ai

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an MCP server that exposes user-invoked board-management tools over stdio/SSE/HTTP and calls the configured Elixium API.

Static reason

No blocking static signals were detected.

Trigger

User runs the declared CLI/MCP server or explicitly runs `npx @elixium.ai/mcp-server init`.

Impact

Tool calls can read or modify the user's Elixium workspace according to supplied credentials; no unconsented host mutation or credential exfiltration was found.

Mechanism

Configured MCP API client with explicit workflow-template initialization.

Rationale

Source inspection shows a package-aligned MCP client with no install-time execution and no concrete malicious chain. The only filesystem mutation is an explicit `init` command that copies its own bundled workflow templates into the current project.

Evidence

package.jsondist/index.jsdist/outbound-auth.jsdist/feature-config-cache.jsdist/streamable-http.jsdist/test-prepare.jstemplates/workflows/manage-board.mdtemplates/workflows/implement-story.mdtemplates/workflows/load-board-context.md

Network endpoints2

elixium.ai/apiconnect.elixium.ai/mcp

@elixium.ai/mcp-server@0.15.0

AI Security Review

Decision evidence

Source & flagged code

Findings