registry / @extenshi/mcp / 0.16.0
@extenshi/mcp@0.16.0
Extenshi MCP server — bring the extension catalog (search, security, market research) and pre-publish scanning into your AI tools
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe postinstall request is gated by recorded telemetry consent and sends limited installation metadata. Runtime entrypoints, flagged sources, and prepared dependency sources were inspected; the scanner signals resolve to product telemetry and user-invoked service functions.
Static reason
One or more suspicious static signals were detected.
Trigger
Telemetry runs after installation only when the shared config records consent, or during runtime when telemetry is enabled; other network actions follow MCP tool calls.
Impact
No confirmed attack surface was established in the inspected source.
Mechanism
The install hook posts an anonymous installation event to PostHog. Runtime analytics strips tool content before event submission; scan requests use the configured Extenshi scan endpoint.
AI rationale
The postinstall request is gated by recorded telemetry consent and sends limited installation metadata. Runtime entrypoints, flagged sources, and prepared dependency sources were inspected; the scanner signals resolve to product telemetry and user-invoked service functions.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs a postinstall hook; the hook sends an install event only after the shared config records telemetry as true, and its payload contains an anonymous install ID and coarse package and platform details.
- Runtime telemetry has opt-out checks; MCP analytics removes tool arguments, results, intent, and error messages before sending events. The server starts when the user launches its stdio entrypoint.
- The reviewed runtime sources describe workspace-confined image reads and user-requested extension scans. The prepared dependencies have no install lifecycle scripts, and their inspected entrypoints export library APIs.
- The required scanner-flagged files contain development-guide data, workspace image validation, and a scan upload to the configured Extenshi scan service; no attack behavior was identified in them.
Evidence against
- The package does perform install-time and runtime network telemetry. The install ping is consent-gated, and the inspected runtime analytics drops tool content before sending.
Behavioral surface
Crypto
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
30import { checkForUpdate } from './update-check.js';
L31: const require = createRequire(import.meta.url);
L32: const pkg = require('../package.json');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L30Findings
2 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/development-guide.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @extenshi/mcp@0.16.0.
See all versions of @extenshi/mcp for other recorded verdicts.
- Review the evidence and your use of @extenshi/mcp@0.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.