registry  /  @gbrandtio/rw-git-mcp  /  3.0.7

@gbrandtio/rw-git-mcp@3.0.7

Model Context Protocol (MCP) server for rw-git

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The main risk is an install-time, package-aligned download of a native MCP executable from GitHub releases without local integrity verification.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall or user-running rw-git-mcp/install-skills
Impact
Runs package-provided MCP git tooling; optional local .agents skill installation on explicit command
Mechanism
downloads versioned native binary; CLI proxies to it; optional skill copy
Rationale
The lifecycle script and child_process use are consistent with installing and launching a versioned native MCP server, and the optional .agents writes require an explicit install-skills command. I found no source evidence of credential theft, persistence, destructive behavior, hidden endpoints, or unconsented AI-agent control-surface mutation.
Evidence
package.jsoninstall.jsbin/cli.jsbin/rw-git-mcp-binskills/rw-git-mcp-installation/SKILL.mdREADME.mdbin/rw-git-mcp-bin.exe.agents/skills/rw-git-mcp
Network endpoints1
github.com/gbrandtio/rw-git/releases/download/v3.0.7/{artifactName}

Decision evidence

public snapshot
AI called this Clean at 78.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json defines postinstall: node install.js
  • install.js downloads a platform executable from GitHub releases and chmods it executable without checksum
  • bin/cli.js can copy bundled skills into .agents/skills/rw-git-mcp only when user runs install-skills
Evidence against
  • install.js only contacts github.com/gbrandtio/rw-git/releases for versioned artifacts
  • bin/cli.js proxies user arguments to bundled bin/rw-git-mcp-bin; no shell=True or command string execution
  • No credential/env harvesting or exfiltration found in JS sources or skills
  • Skills are repository-reporting workflows aligned with the MCP/git package purpose
  • Bundled bin/rw-git-mcp-bin is an inert GitHub HTML page, not an executable payload
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.54 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings