registry / @letretro/mcp / 0.1.4

@letretro/mcp@0.1.4

LetRetro MCP — Connect Claude, Cursor, VS Code, Codex, OpenCode, Antigravity, Hermes, OpenClaw, Windsurf, and Continue to your LetRetro retrospectives.

AI Security Review

scanned 14h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `letretro-mcp install` and selects clients; later, an MCP client invokes its tools.

Impact

Selected clients will launch this package and send LetRetro-authorized MCP requests to the hosted service.

Mechanism

Interactive AI-agent configuration mutation and authenticated remote MCP proxying.

Rationale

No concrete malicious chain or unconsented lifecycle mutation was found. The explicit installer modifies AI-agent control surfaces and installs a remotely backed MCP capability, which warrants a warning under policy.

Evidence

package.jsondist/index.jsdist/install-SWIJAQNR.jsdist/server-KCDLJRZG.js~/.codex/config.toml~/.cursor/mcp.json~/.openclaw/openclaw.json

Network endpoints1

mcp.letretro.com

Decision evidence

public snapshot

AI called this at 90.0% confidence with false-positive risk.

@letretro/mcp@0.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code