@hailer/mcp@1.3.55

MCP server for Hailer - provides 52 tools to AI assistants (Claude Desktop, Claude Code).

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The postinstall hook automatically installs package-owned Claude skills into the consumer project, which is a first-party agent extension lifecycle risk. The inspected source supports a warning, but not a malicious verdict or publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package triggers the skill copy; starting the MCP server triggers the port update.

Impact

The install adds package-owned agent guidance to the project, creating an agent extension lifecycle risk.

Mechanism

The hook recursively copies the package's .claude directory into the project root, while the server updates an existing Hailer localhost address in .mcp.json.

AI rationale

Evidence

package.jsonscripts/postinstall.cjs.claude/skills/hailer-app-builder/SKILL.mddist/server/mcp-server.js.claude/.mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package's postinstall hook runs scripts/postinstall.cjs automatically.
The hook copies packaged .claude files into the consumer project; it skips when no project root is found and preserves an existing settings.local.json.
A packaged skill provides Hailer app-building guidance for Claude Code.
When the server starts, it updates the port only in an existing Hailer MCP entry with a localhost address.

Evidence against

The reviewed postinstall behavior is a local copy of package-owned Hailer skills; it contains no network transfer or remote payload execution.
The runtime MCP configuration change is limited to the existing Hailer server's localhost port.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 128 file(s), 1.65 MB of source, external domains: 127.0.0.1, api.hailer.com, app.hailer.com, apps.hailer.com, d1.awsstatic.com, docs.hailer.com, example.com, form.hailer.com, logs.hailer.local.gd

Source & flagged code

16 flagged

package.jsonView file

Lines 9-49json

9 "scripts": {

10 "dev": "tsx watch src/server/app.ts",

11 "claude-code-mcp": "DISABLE_CLIENT=true tsx src/server/app.ts",

12 "start-mcp-only": "DISABLE_CLIENT=true tsx src/server/app.ts",

13 "start-client-only": "DISABLE_MCP_SERVER=true tsx src/server/app.ts",

14 "build": "rm -rf dist && tsc && cp src/mcp/instructions.md dist/mcp/",

15 "prepack": "npm run build",

16 "start": "node dist/server/app.js",

17 "lint": "eslint src/ --max-warnings 0",

18 "pipeline-lint": "node node_modules/@hailer-repos/eslint-config/lint-new-violations.mjs -c eslint.config.mjs",

19 "typecheck": "tsc --noEmit -p tsconfig.eslint.json",

20 "build-dev-push": "rm -rf build/docker-dev && docker build --target artifacts --output build/docker-dev . -f Dockerfile.build-dev && docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):dev -f ./Dockerfile.dev .",

21 "build-debug-push": "docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-debug -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):debug -f ./Dockerfile.debug .",

22 "build-prod-push": "rm -rf build/docker-prod && docker build --target artifacts --output build/docker-prod . -f Dockerfile.build-prod && docker buildx build --push --platform linux/amd64,linux/arm64/v8 -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs) -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):prod -f ./Dockerfile.prod .",

24 "build-k3d-dummy": "docker build --target artifacts --output build/docker-dev . -f Dockerfile.build-dev && docker build -f Dockerfile.dev . -t $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev && k3d image import $(npm pkg get config.docker.registry | xargs)/$(npm pkg get name | xargs | sed 's/@hailer\\//hailer-/'):$(npm pkg get version | xargs)-dev -c hailer",

25 "mcp-server": "hailer-mcp",

26 "release:patch": "npm version patch -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

27 "release:minor": "npm version minor -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

28 "release:major": "npm version major -m 'chore: release v%s' && git push && git push --tags && npm run build && npm publish --access public",

29 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test": "vitest run",

31 "test:coverage": "vitest run --coverage",

32 "test:live": "vitest run --config vitest.live.config.ts",

33 "evals": "tsx evals/run-evals.ts",

34 "evals:bot": "tsx evals/run-bot-evals.ts",

35 "ci:trigger": "tsx test/live/trigger-pipeline.ts"

36 },

37 "files": [

38 "dist/",

39 "scripts/",

40 "!scripts/probe-mcp-pricing.ts",

41 ".claude/skills/",

42 ".opencode/",

43 "CLAUDE.md",

44 ".env.example",

45 "CHANGELOG.md",

46 "README.md"

47 ],

48 "dependencies": {

49 "@anthropic-ai/sdk": "^0.54.0",

scripts/postinstall.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * postinstall: Copies .claude/ (agents, skills, hooks) to the project root.

4 * Runs automatically after `npm install @hailer/mcp`.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L2

5 * Skips when installing in the hailer-mcp repo itself (development).

6 */

7const fs =

scripts/build-public-chat-knowledge.pyView file

•path = scripts/build-public-chat-knowledge.py kind = build_helper sizeBytes = 3462 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-public-chat-knowledge.pyView on unpkg

dist/bot/services/operation-logger.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bot/services/operation-logger.js#virtual:normalized:round1View on unpkg

dist/mcp/publish-auth-injector.jsView file

•matchType = normalized_sha256 matchedPackage = @hailer/mcp@1.3.56 matchedPath = dist/mcp/publish-auth-injector.js matchedIdentity = npm:QGhhaWxlci9tY3A:1.3.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High