registry  /  @gbrandtio/rw-git-mcp  /  3.2.5

@gbrandtio/rw-git-mcp@3.2.5

Model Context Protocol (MCP) server for rw-git

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Postinstall fetches a native payload from GitHub Releases and writes it under bin/. The CLI later executes that file. No direct credential theft or automatic agent-config write is confirmed.

Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs postinstall; invoking rw-git-mcp runs the fetched binary.
Impact
Release-host compromise or redirect abuse could replace the subsequently executed payload.
Mechanism
unverified remote native-binary download followed by CLI execution
Rationale
The package has a real remote native-payload supply-chain risk because installation fetches an unsigned executable that the CLI executes. Source does not show a concrete malicious objective, so a warning is more appropriate than a block.
Evidence
package.jsoninstall.jsbin/cli.jsskills/rw-git-mcp-installation/SKILL.mdbin/rw-git-mcp-bin
Network endpoints1
github.com/gbrandtio/rw-git/releases/download/v${version}/${artifactName}

Decision evidence

public snapshot
AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • package.json runs postinstall via install.js.
  • install.js downloads a platform binary during installation.
  • Downloaded executable has no checksum/signature verification.
  • bin/cli.js executes the downloaded binary with spawn.
  • Installation skill instructs agent configuration edits when requested.
Evidence against
  • Download URL is package-aligned GitHub Releases.
  • No source evidence of credential harvesting or exfiltration.
  • No automatic AI-client config mutation in lifecycle code.
  • Skill extraction only occurs through explicit install-skills command.
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.54 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings