registry / @libraz/formulon-mcp / 0.3.0

@libraz/formulon-mcp@0.3.0

MCP server for Formulon Excel-compatible formula and workbook evaluation

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `formulon-mcp init`, selects targets, and confirms.

Impact

Registers `npx -y @libraz/formulon-mcp` as the selected client's Formulon MCP server.

Mechanism

Interactive MCP client configuration mutation.

Rationale

Source inspection found explicit, user-confirmed MCP setup but no concrete malicious behavior. Per policy, explicit agent-config mutation warrants a warning rather than a block.

Evidence

package.jsondist/index.jsdist/init.jsdist/formulon.jsdist/sessions.js~/.claude.json./.mcp.json~/.codex/config.toml~/Library/Application Support/Claude/claude_desktop_config.json

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

@libraz/formulon-mcp@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code