registry / @eventmodelers/cli / 2.0.37
@eventmodelers/cli@2.0.37
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is a purpose-built Eventmodelers CLI with no install lifecycle hook. Its credential prompts, service requests, and local agent configuration are consistent with explicit setup and use of the documented service.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs an explicit CLI setup or modeling command.
Impact
Expected service use and local setup changes; no unauthorized credential collection, unrelated account action, or harmful install-time behavior was identified.
Mechanism
The CLI prompts for Eventmodelers credentials, stores configuration locally, and registers the configured Eventmodelers MCP endpoint. Prototype setup also denies board write tools to the agent.
AI rationale
The package is a purpose-built Eventmodelers CLI with no install lifecycle hook. Its credential prompts, service requests, and local agent configuration are consistent with explicit setup and use of the documented service.
Evidence
.eventmodelers/config.json.mcp.json.claude/settings.local.jsonCLAUDE.md
Network endpoints2
api.eventmodelers.aiapp.eventmodelers.ai
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes `cli.js` as its command and declares no install lifecycle script; its only script is `test`.
- The CLI defaults to the Eventmodelers API at `https://api.eventmodelers.ai`.
- Credential setup prompts the user to paste or enter Eventmodelers credentials.
- MCP configuration sends the Eventmodelers token to the configured `/mcp` endpoint.
- The prototype extension adds board write tools to Claude Code's local deny list.
Evidence against
- The CLI reads an explicitly configured base URL, so credentials can be sent to a custom endpoint when the user configures one.
- The CLI writes local MCP and agent settings as part of setup commands.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flaggedstacks/supabase/templates/root/src/common/testHelpers.tsView file
1import {execSync} from 'child_process';
L2: import {readFileSync, writeFileSync, unlinkSync} from 'fs';
High
Child Process
Package source references child process execution.
stacks/supabase/templates/root/src/common/testHelpers.tsView on unpkg · L1shared/build-kit/ralph-exec.jsView file
121stdio: ['inherit', traced ? 'pipe' : 'inherit', 'inherit'],
L122: shell: true,
L123: env: { ...childEnv, RALPH_PROMPT_FILE: promptFile, ...extraEnv },
High
stacks/supabase/templates/root/server.tsView file
Findings
8 High5 Medium5 Low
HighChild Processstacks/supabase/templates/root/src/common/testHelpers.ts
HighShellshared/build-kit/ralph-exec.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighCredential Redirect Persistencecli.js
HighExternal Ai Agent Control Surface Mutationcli.js
HighTrigger Reachable External Ai Agent Control Surface Mutationextensions/prototype/index.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/supabase/templates/root/server.ts
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @eventmodelers/cli@2.0.37.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@2.0.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.