registry  /  @gbrandtio/rw-git-mcp  /  3.0.10

@gbrandtio/rw-git-mcp@3.0.10

Model Context Protocol (MCP) server for rw-git

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious behavior was found, but install-time unauthenticated native binary download creates unresolved supply-chain risk. Runtime CLI executes whatever binary install.js places in bin/.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; CLI use runs rw-git-mcp
Impact
Potential execution of unverified release artifact if upstream or redirect content is compromised
Mechanism
install-time remote binary download and runtime child process proxy
Rationale
Static inspection did not show credential theft, exfiltration, destructive behavior, or unconsented AI-agent control-surface mutation. The package should be warned rather than blocked because its main risk is an unverified install-time binary download and executable proxy, not concrete malicious code in the package.
Evidence
package.jsoninstall.jsbin/cli.jsbin/rw-git-mcp-binskills/rw-git-mcp-installation/SKILL.mdbin/rw-git-mcp-bin.exe.agents/skills/rw-git-mcp
Network endpoints2
github.com/gbrandtio/rw-git/releases/download/v${version}/${artifactName}github.com/gbrandtio/rw-git.git

Decision evidence

public snapshot
AI called this Suspicious at 77.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node install.js
  • install.js downloads a platform executable from GitHub Releases at install time without checksum/signature verification
  • bin/cli.js proxies all CLI args to bin/rw-git-mcp-bin via child_process.spawn
  • packaged bin/rw-git-mcp-bin is executable but contains GitHub 404 HTML, suggesting broken or replaced binary artifact handling
Evidence against
  • install.js network endpoint is package-aligned: github.com/gbrandtio/rw-git releases
  • No credential/env harvesting, destructive file operations, persistence, or exfiltration found in JS source
  • bin/cli.js install-skills copies bundled skills only when user explicitly runs install-skills
  • Bundled skills are reporting/installation guidance for rw_git MCP and do not contain reviewer/prompt hijack instructions
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.54 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings