registry / @hypertabai/mcp / 1.0.0

@hypertabai/mcp@1.0.0

One-command Hypertab MCP installer and client for Claude Code, Cursor, Windsurf, and more.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit user commands can install an authenticated Hypertab MCP server and, for Claude Code, a remotely fetched skill. This is first-party agent-extension setup, not install-time hijacking.

Static reason

No blocking static signals were detected.

Trigger

User runs `hypertab install`, `bridge`, or `surfaces publish` commands.

Impact

A mutable Hypertab skill/server configuration can influence the selected AI client after explicit installation.

Mechanism

User-invoked MCP configuration, remote skill installation, and optional project build/upload

Rationale

No concrete malicious behavior was found, but the package intentionally configures AI-agent control surfaces and installs remotely sourced skill content. This is a guarded first-party extension lifecycle risk requiring a warning under policy.

Evidence

package.jsondist/index.jsdist/install/platforms.jsdist/install/config-writer.jsdist/install/skill-writer.jsdist/bridge/command-contract.js~/.claude.json~/.claude/skills/hypertab/SKILL.md./.mcp.json./.cursor/mcp.json~/.cursor/mcp.json~/.hypertab/bridge-spool.jsonl

Network endpoints3

api.hypertab.ai/mcp

@hypertabai/mcp@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code