registry / @letretro/mcp / 0.1.4

@letretro/mcp

@0.1.4

LetRetro MCP — Connect Claude, Cursor, VS Code, Codex, OpenCode, Antigravity, Hermes, OpenClaw, Windsurf, and Continue to your LetRetro retrospectives.

AI Security Review

scanned 14h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `letretro-mcp install` and selects clients; later, an MCP client invokes its tools.

Impact

Selected clients will launch this package and send LetRetro-authorized MCP requests to the hosted service.

Mechanism

Interactive AI-agent configuration mutation and authenticated remote MCP proxying.

Rationale

No concrete malicious chain or unconsented lifecycle mutation was found. The explicit installer modifies AI-agent control surfaces and installs a remotely backed MCP capability, which warrants a warning under policy.

Evidence

package.jsondist/index.jsdist/install-SWIJAQNR.jsdist/server-KCDLJRZG.js~/.codex/config.toml~/.cursor/mcp.json~/.openclaw/openclaw.json

Network endpoints1

mcp.letretro.com

Decision evidence

public snapshot

AI called this at 90.0% confidence with false-positive risk.

Suspicious

as Dangerous Capability

low

Evidence for warning

`dist/install-SWIJAQNR.js` prompts for an API key and validates it by POSTing a bearer token.
Explicit `install` writes a `letretro` MCP entry into selected AI-client configs.
The installed MCP server forwards `tools/list` and `tools/call` to a remote service with that bearer token.
`execSync` is limited to `which`/`where` client detection.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
Config writes occur only after `letretro-mcp install`, detection, and an interactive client selection.
The remote host is package-aligned: `https://mcp.letretro.com`.
No payload download, eval, destructive operation, or unrelated credential harvesting was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 20.3 KB of source, external domains: letretro.com, mcp.letretro.com

Source & flagged code

1 flagged

dist/install-SWIJAQNR.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/install-SWIJAQNR.js` prompts for an API key and validates it by POSTing a bearer token.

dist/install-SWIJAQNR.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/install-SWIJAQNR.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/install-SWIJAQNR.js` prompts for an API key and validates it by POSTing a bearer token.

dist/install-SWIJAQNR.jsView on unpkg

Findings

6 Medium3 Low

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencedist/install-SWIJAQNR.js

MediumAi Review Evidence

LowScripts Present

LowFilesystem

LowUrl Strings

LPM CLI

Runtime surface

package.json

Entrypointsbin → letretro-mcp

Runtimenode >=18

Artifact72.4 KB · 9 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, dev, test, typecheck

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkShellUrlStringsManifest: clean

Source & flagged code

1 flagged

dist/install-SWIJAQNR.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/install-SWIJAQNR.js` prompts for an API key and validates it by POSTing a bearer token.

dist/install-SWIJAQNR.jsView on unpkg