@eventmodelers/cli@1.0.103
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe CLI silently removes an explicit project-level MCP disablement and enables the Eventmodelers server during setup or runner startup. Because this is user-command-triggered and project-scoped, the evidence supports a warning for agent capability abuse rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Invoking project setup or the Claude runner through the CLI.
Impact
A prior project-level refusal can be overridden, allowing the agent to use the configured Eventmodelers MCP server.
Mechanism
The CLI writes the project MCP registration, removes Eventmodelers from the disabled-server list, and adds it to the enabled-server list.
AI rationale
The CLI silently removes an explicit project-level MCP disablement and enables the Eventmodelers server during setup or runner startup. Because this is user-command-triggered and project-scoped, the evidence supports a warning for agent capability abuse rather than a publish block.
Evidence
package.jsoncli.jsshared/build-kit/lib/mcp-register.js.mcp.json.claude/settings.local.jsonopencode.json.gemini/settings.json
Network endpoints1
api.eventmodelers.ai/mcp
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI entry point and declares no install lifecycle hook.
- The listed agent-host directories are project paths for skill stubs; that mapping alone does not change agent permissions.
- During project setup, the CLI registers the MCP server, supplies a token environment reference, and enables the server.
- The Claude settings helper removes Eventmodelers from the project's disabled MCP list and adds it to the enabled list.
- The shared harness registration writes to the agent's project configuration; its helper creates or updates the specified project file.
- The Claude runner can rewrite MCP registration and re-enable the server before launch; its default service endpoint is the Eventmodelers API.
Evidence against
- The configuration changes are triggered by CLI setup or run commands, not npm installation.
- The traced writes are project-scoped; the source describes the shared harness config as not user-wide.
- The inspected paths did not establish credential theft, unrelated data collection, destructive behavior, or remote code execution.
Behavioral surface
Source & flagged code
9 flaggedstacks/bridge/templates/bridge/ralph-local-ai.jsView file
12import { startRalph } from './lib/ralph.js';
L13: import { spawn } from 'child_process';
L14: import { dirname, join, resolve } from 'path';
High
Child Process
Package source references child process execution.
stacks/bridge/templates/bridge/ralph-local-ai.jsView on unpkg · L12stacks/bridge/templates/bridge/ralph-hook.jsView file
68cwd: projectDir,
L69: shell: true,
L70: stdio: 'inherit',
High
Shell
Package source references shell execution.
stacks/bridge/templates/bridge/ralph-hook.jsView on unpkg · L68stacks/bridge/templates/bridge/ralph-static.jsView file
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/bridge/templates/bridge/ralph-local-ai.js
HighShellstacks/bridge/templates/bridge/ralph-hook.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/bridge/templates/bridge/ralph-static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
Affected versions and remediation
This report applies to @eventmodelers/cli@1.0.103.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@1.0.103 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.