@eventmodelers/cli@1.0.151
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe CLI explicitly changes project-local MCP settings, including clearing a prior disabled entry, which leaves a concrete agent configuration risk. The behavior is user-triggered and uses the package’s service, so the source supports a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes the CLI run path for a project.
Impact
The project’s agent may use the Eventmodelers MCP server despite a prior project-level disablement.
Mechanism
The CLI registers the MCP server and removes its name from the project’s disabled list while adding it to the enabled list.
AI rationale
The CLI explicitly changes project-local MCP settings, including clearing a prior disabled entry, which leaves a concrete agent configuration risk. The behavior is user-triggered and uses the package’s service, so the source supports a warning rather than a publish block.
Evidence
cli.js.mcp.json.claude/settings.local.json
Network endpoints1
api.eventmodelers.ai
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Invoking the CLI run path registers the Eventmodelers server, prepares its token, and enables it in project settings.
- The settings helper removes `eventmodelers` from the project’s disabled server list and adds it to the enabled list; registration stores a server URL and environment references for headers.
- The package defines project-specific agent command and workflow directories.
- The package manifest exposes a CLI and has no install lifecycle hook.
- The snippet guard checks that reply text is a string before stripping delimiters; the Supabase adapter passes a token to the Supabase client’s authentication method.
Evidence against
- The MCP settings change occurs through a CLI run path and is limited to project-local settings and registration files.
- The default endpoint belongs to the Eventmodelers service; the inspected source does not show credentials sent to an unrelated recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
9 flaggedstacks/bridge/templates/bridge/ralph-local-ai.jsView file
12import { startRalph } from './lib/ralph.js';
L13: import { spawn } from 'child_process';
L14: import { dirname, join, resolve } from 'path';
High
Child Process
Package source references child process execution.
stacks/bridge/templates/bridge/ralph-local-ai.jsView on unpkg · L12stacks/bridge/templates/bridge/ralph-hook.jsView file
68cwd: projectDir,
L69: shell: true,
L70: stdio: 'inherit',
High
Shell
Package source references shell execution.
stacks/bridge/templates/bridge/ralph-hook.jsView on unpkg · L68stacks/bridge/templates/bridge/ralph-static.jsView file
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/bridge/templates/bridge/ralph-local-ai.js
HighShellstacks/bridge/templates/bridge/ralph-hook.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/bridge/templates/bridge/ralph-static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
Affected versions and remediation
This report applies to @eventmodelers/cli@1.0.151.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@1.0.151 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.