registry / @iterate.ai/agentone-token-compression / 1.1.14

@iterate.ai/agentone-token-compression@1.1.14

AgentOne Token Compression by Iterate.ai. One npm install gives you 40–90% token savings in Claude Code, Claude CLI, and Claude Desktop. Compresses tool outputs, prompts, file reads, and conversation context. Mask-union architecture protects API keys, UUI

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time execution occurs. Explicit CLI setup commands modify first-party AgentOne/Claude extension configuration and install hooks that process Claude input locally. No confirmed exfiltration or remote execution path was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `agentone-tc install`, `install-desktop`, or starts the MCP/hooks.

Impact

Configured hooks can transform Claude prompts and tool output; setup changes Claude configuration and launches package-owned local code in future Claude sessions.

Mechanism

User-invoked Claude hook/MCP extension setup with local cache persistence.

Rationale

Source establishes real, user-invoked AI-agent configuration mutation and persistent hook installation, warranting a warning. It does not establish malicious behavior because there are no lifecycle hooks, network clients, shell execution paths, or concrete exfiltration chain.

Evidence

package.jsoncli/agentone-tc.jsmcp-server/index.jssettings.jsonscripts/set-statusline.jshooks/compress-tool-output.jshooks/compress-prompt.jshooks/session-start.jshooks/session-end.jshooks/statusline.js~/.claude/settings.json~/.claude/plugins/agentone-token-compression/Claude Desktop/claude_desktop_config.json

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `install` copies hooks, commands, and a skill into `~/.claude`.
`install` merges package hook commands into `~/.claude/settings.json`.
`install-desktop` writes this package's MCP entry to Claude Desktop config.
MCP persists compressed-body/cache data under its package data directory.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle scripts.
No network client, shell execution, eval, or remote payload loader found.
MCP accepts local stdio JSON-RPC and exposes compression/statistics tools.
Dynamic require is limited to fixed package-local MCP/stat script candidates.
Unicode finding is an intentional zero-width-character sanitization regex.
SHA-1 is only used to derive short local body-store identifiers.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 1.63 MB of source, external domains: github.com, iterate.ai

Source & flagged code

3 flagged

mcp-server/index.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

3"use strict";

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __commonJS = (cb, mod) => function __require() {

6 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server/index.jsView on unpkg · L4

7};

9// ../nodejs_optimizer/src/utils/contentDetect.js

10var require_contentDetect = __commonJS({

11 "../nodejs_optimizer/src/utils/contentDetect.js"(exports2, module2) {

12 "use strict";

14 var SQL_HINTS = /\b(?:SELECT\s+[\w*,\s]+\s+FROM|INSERT\s+INTO\s+\w+|UPDATE\s+\w+\s+SET|DELETE\s+FROM\s+\w+|CREATE\s+TABLE\s+\w+)

15 var LOG_HINTS = /^\s*(\[?\d{4}-\d{2}-\d{2}|\[?(DEBUG|INFO|WARN|ERROR|TRACE)\b)/im;

16 var MARKDOWN_HINTS = /^\s*(#{1,6}\s|```|\* |- |\d+\. )/m;

17 function detectContentType(text) {

18 if (!text || typeof text !== "string") return "prose";

19 const trimmed = text.trim();

20 if (trimmed.length === 0) return "prose";

21 if ((trimmed[0] === "{" || trimmed[0] === "[") && trimmed.length > 1) {

22 const last = trimmed[trimmed.length - 1];

23 if (trimmed[0] === "{" && last === "}" || trimmed[0] === "[" && last === "]") {

24 try {

25 JSON.parse(trimmed);

26 return "json";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mcp-server/index.jsView on unpkg · L24

27 } catch {

28 }

29 }

30 }

31 if (trimmed[0] === "<" && /<\/?[a-z][\s\S]*?>/i.test(trimmed)) {

32 if (/<!DOCTYPE\s+html|<html[\s>]|<body[\s>]|<div[\s>]/i.test(trimmed)) return "html";

33 return "xml";

34 }

35 const lines = trimmed.split("\n").slice(0, 5);

36 if (lines.length >= 2) {

37 const commaCounts = lines.map((l) => (l.match(/,/g) || []).length);

38 if (commaCounts[0] >= 2 && commaCounts.every((c) => c === commaCounts[0])) {

39 return "csv";

40 }

41 }

42 if (LOG_HINTS.test(trimmed)) return "log";

43 if (SQL_HINTS.test(trimmed)) return "sql";

44 if (CODE_HINTS.test(trimmed)) return "code";

Lines 596-636javascript

596 const fnPat = /\b(export\s+)?(async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*(?:<[^<>{}]*>)?\s*$[^)]*$

Source & flagged code

3 flagged · loading source

mcp-server/index.jsView file

616contains invisible/control Unicode U+200B (zero width space) var ZERO_WIDTH = /[<U+200B>-<U+200D><U+FEFF><U+2060>]/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

mcp-server/index.jsView on unpkg · L616

4var __getOwnPropNames = Object.getOwnPropertyNames; L5: var __commonJS = (cb, mod) => function __require() { L6: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server/index.jsView on unpkg · L4

24try { L25: JSON.parse(trimmed); L26: return "json"; ... L115: const replaced = replaceStrings(value, refMap); L116: return { __refs: refs, data: replaced }; L117: } ... L404: if (/^\s*(?:fn\s+\w+\s*\(|let\s+mut|use\s+\w+::)/m.test(text)) return "rust"; L405: if (/^\s*(?:public\s+class|private\s+\w|protected\s+\w)/m.test(text)) return "java"; L406: if (/^#!\/(?:usr\/)?bin\/(?:bash|sh|zsh)/.test(text)) return "shell"; ... L4294: } catch (e) { L4295: const fallback = path2.resolve(__dirname, "..", "..", "nodejs_optimizer", "src", "index.js"); L4296: const lib = require(fallback);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mcp-server/index.jsView on unpkg · L24

Findings

1 Critical3 Medium4 Low

CriticalTrojan Source Unicodemcp-server/index.js

MediumDynamic Requiremcp-server/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowWeak Cryptomcp-server/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

89%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorIterate.ai

Maintainersiterate.ai

Version1.1.14

PublishedJul 15, 2026

LicenseLicenseRef-Iterate-AgentOne

Dependencies0

Integrityverified

Package size408 KB

Files37

Keywordsagentoneiterate-aiclaude-codeclaude-cliclaude-desktopclaude-pluginmcpmodel-context-protocol

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./cli/agentone-tc.jsbin → agentone-tc, agentone-token-compression

Runtimenode >=18.0.0

Artifact1.72 MB · 37 files1 signature(s)

Install lifecycleNo scripts declared.

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

3 flagged

mcp-server/index.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

3"use strict";

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __commonJS = (cb, mod) => function __require() {

6 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server/index.jsView on unpkg · L4

7};

9// ../nodejs_optimizer/src/utils/contentDetect.js

10var require_contentDetect = __commonJS({

11 "../nodejs_optimizer/src/utils/contentDetect.js"(exports2, module2) {

12 "use strict";

14 var SQL_HINTS = /\b(?:SELECT\s+[\w*,\s]+\s+FROM|INSERT\s+INTO\s+\w+|UPDATE\s+\w+\s+SET|DELETE\s+FROM\s+\w+|CREATE\s+TABLE\s+\w+)

15 var LOG_HINTS = /^\s*(\[?\d{4}-\d{2}-\d{2}|\[?(DEBUG|INFO|WARN|ERROR|TRACE)\b)/im;

16 var MARKDOWN_HINTS = /^\s*(#{1,6}\s|```|\* |- |\d+\. )/m;

17 function detectContentType(text) {

18 if (!text || typeof text !== "string") return "prose";

19 const trimmed = text.trim();

20 if (trimmed.length === 0) return "prose";

21 if ((trimmed[0] === "{" || trimmed[0] === "[") && trimmed.length > 1) {

22 const last = trimmed[trimmed.length - 1];

23 if (trimmed[0] === "{" && last === "}" || trimmed[0] === "[" && last === "]") {

24 try {

25 JSON.parse(trimmed);

26 return "json";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mcp-server/index.jsView on unpkg · L24

27 } catch {

28 }

29 }

30 }

31 if (trimmed[0] === "<" && /<\/?[a-z][\s\S]*?>/i.test(trimmed)) {

32 if (/<!DOCTYPE\s+html|<html[\s>]|<body[\s>]|<div[\s>]/i.test(trimmed)) return "html";

33 return "xml";

34 }

35 const lines = trimmed.split("\n").slice(0, 5);

36 if (lines.length >= 2) {

37 const commaCounts = lines.map((l) => (l.match(/,/g) || []).length);

38 if (commaCounts[0] >= 2 && commaCounts.every((c) => c === commaCounts[0])) {

39 return "csv";

40 }

41 }

42 if (LOG_HINTS.test(trimmed)) return "log";

43 if (SQL_HINTS.test(trimmed)) return "sql";

44 if (CODE_HINTS.test(trimmed)) return "code";

Lines 596-636javascript

596 const fnPat = /\b(export\s+)?(async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*(?:<[^<>{}]*>)?\s*$[^)]*$