registry / @lousy-agents/mcp / 5.17.3

@lousy-agents/mcp@5.17.3

MCP server for lousy-agents - provides AI coding assistant tools via the Model Context Protocol

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An MCP client invokes `create_claude_code_web_setup` or `create_copilot_setup_workflow`.

Impact

Future Claude Code sessions may execute generated environment or dependency-install commands; CI workflow configuration may be created or changed.

Mechanism

Explicit MCP-driven project configuration and hook creation.

Rationale

This is not concrete malicious package behavior, but it provides an explicit AI-agent configuration mutation capability that can create future command execution in a target project. Warn rather than block because writes are tool-invoked and no unconsented install-time control-surface mutation was found.

Evidence

package.jsondist/mcp-server.jsdist/913.jstargetDir/.claude/settings.jsontargetDir/CLAUDE.mdtargetDir/.github/workflows/copilot-setup-steps.ymltargetDir/.github/workflows/copilot-setup-steps.yaml

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/mcp-server.js` registers `create_claude_code_web_setup`, an MCP tool that writes target-project `.claude/settings.json` and `CLAUDE.md`.
The tool derives SessionStart hooks that can run environment/package setup commands such as `mise install`, `nvm install`, and configured package-manager installs.
`dist/mcp-server.js` also exposes a tool that creates or updates `.github/workflows/copilot-setup-steps.yml` in the selected target directory.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
The entrypoint starts an MCP stdio server; configuration writes occur only through registered tool handlers after an MCP request.
No `fetch`, HTTP request, or WebSocket call site was found in the inspected package entrypoint/chunk code.
The flagged invisible Unicode in `dist/913.js` occurs in bundled JSON5 parser handling, not an obscured payload.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 9 file(s), 605 KB of source, external domains: api.github.com, bitbucket.com, bitbucket.org, caniuse.com, gist.github.com, git.sr.ht, github.com, gitlab.com, jmrware.com, json-schema.org, mathiasbynens.be, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.w3.org

Oversized source lightweight scan

dist/mcp-server.js2.38 MB file, sampled 256 KB

ChildProcessEvalHighEntropyStringsUrlStringscaniuse.comgist.github.comgithub.comjmrware.comjson-schema.orgmathiasbynens.bespec.openapis.orgstackoverflow.comtools.ietf.orgwww.w3.org

Source & flagged code

3 flagged

dist/913.jsView file

Lines 1-40javascript

1export const __rspack_esm_id = 913;

2export const __rspack_esm_ids = [913];

3export const __webpack_modules__ = {

42576(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {

6// EXPORTS

7__webpack_require__.d(__webpack_exports__, {

8 parseJSON5: () => (/* binding */ json5_s)

9});

11// UNUSED EXPORTS: stringifyJSON5

13// EXTERNAL MODULE: external "node:module"

14var external_node_module_ = __webpack_require__(8995);

15;// CONCATENATED MODULE: ../../node_modules/confbox/dist/_chunks/rolldown-runtime.mjs

16var rolldown_runtime_e=Object.create,rolldown_runtime_t=Object.defineProperty,rolldown_runtime_n=Object.getOwnPropertyDescriptor,rolldown_runtime_r=Object.getOwnPropertyNames,rolldown_runtime_i=Object.getPrototypeOf,rolldown_runtime_a=Object.prototype.hasOwnProperty,rolldown_runtime_o=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),rolldown_runtime_s=(e,i,o,s)=>{if

17// EXTERNAL MODULE: ../../node_modules/confbox/dist/_chunks/_format.mjs

18var _format = __webpack_require__(5492);

19;// CONCATENATED MODULE: ../../node_modules/confbox/dist/_chunks/libs/json5.mjs

20var json5_t=rolldown_runtime_o(((e,t)=>{t.exports.Space_Separator=/[\u1680\u2000-\u200A\u202F\u205F\u3000]/,t.exports.ID_Start=/[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0

21`?(c++,l=0):e?l+=e.length:l++,e&&(s+=e.length),e}let S={default(){switch(v){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case``:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/913.jsView on unpkg · L21

22`:case`\r`:case`\u2028`:case`\u2029`:x();return;case`/`:x(),m=`comment`;return;case void 0:return x(),C(`eof`)}if(r.isSpaceSeparator(v)){x();return}return S[a]()},comment(){switch(v){case`*`:x(),m=`multiLineComment`;return;case`/`:x(),m=`singleLineComment`;return}throw j(x())},multiLineComment(){switch(v){case`*`:x(),m=`multiLineCommentAsterisk`;return;case void 0:throw j(x())}x()},multiLineCommentAsterisk(){switch(v){case`*`:x();return;case`/`:x(),m=`default`;return;case void 0:throw j(x())}x(),m=`multiLineComment`},singleLineComment(){switch(v){case`

23`:case`\r`:case`\u2028`:case`\u2029`:x(),m=`default`;return;case void 0:return x(),C(`eof`)}x()},value(){switch(v){case`{`:case`[`:return C(`punctuator`,x());case`n`:return x(),w(`ull`),C(`null`,null);case`t`:return x(),w(`rue`),C(`boolean`,!0);case`f`:return x(),w(`alse`),C(`boolean`,!1);case`-`:case`+`:x()===`-`&&(_=-1),m=`sign`;return;case`.`:h=x(),m=`

24`:case`\r`:throw j(x());case`\u2028`:case`\u2029`:P(v);break;case void 0:throw j(x())}h+=x()},start(){switch(v){case`{`:case`[`:return C(`punctuator`,x())}m=`value`},beforePropertyName(){switch(v){case`$`:case`_`:h=x(),m=`identifierName`;return;case`\\`:x(),m=`identifierNameStartEscape`;return;case`}`:return C(`punctuator`,x());case`"`:case`'`:g=x()===`"`,m=`string`;return}if(r.isIdStartChar(v)){h+=x(),m=`identifierName`;return}throw j(x())},afterPropertyName(){if(v===`:`)return C(`punctuator`,x());throw j(x())},beforePropertyValue(){m=`value`},afterPropertyValue(){switch(v){case`,`:case`

25`;case`r`:return x(),`\r`;case`t`:return x(),` `;case`v`:return x(),`\v`;case`0`:if(x(),r.isDigit(b()))throw j(x());return`\0`;case`x`:return x

26`:case`\u2028`:case`\u2029`:return x(),``;case`\r`:return x(),b()===`

27`&&x(),``;case`1`:case`2`:case`3`:case`4`:case`5`:case`6`:case`7`:case`8`:case`9`:throw j(x());case void 0:throw j(x())}return x()}function E(){

28`+a;e=r.join(n),s=`{

29`+a+e+`,

30`+t+`}`}}return i.pop(),a=t,s}function p(e){if(e.length===0)return d(e,!0);let t=String.fromCodePoint(e.codePointAt(0));if(!r.isIdStartChar(t))return d(e,!0);for(let n=t.length;n<e.length;n++)if(!r.isIdContinueChar(String.fromCodePoint(e.codePointAt(n))))return d(e,!0);return e}function m(e){if(i.indexOf(e)>=0)throw TypeError(`Converting circular structure to JSON5`);i.push(e);let t=a;a+=c;let n=[];for(let t=0;t<e.length;t++){let r=u(String(t),e);n.push(r===void 0?`null`:r)}let r;if(n.length===0)r=`[]`;else if(c===``)r=`[`+n.join(`,`)+`]`;else{let e=`,

31`+a,i=n.join(e);r=`[

32`+a+i+`,

33`+t+`]`}return i.pop(),a=t,r}}}));

34;// CONCATENATED MODULE: ../../node_modules/confbox/dist/json5.mjs

35var json5_a=rolldown_runtime_c(json5_r(),1),json5_o=rolldown_runtime_c(json5_i(),1);function json5_s(e,n){let r=(0,json5_a.default)(e,n?.reviver);return (0,_format.n)(e,r,n),r}function json5_c(e,t){let r=n(e,t),i=(0,json5_o.default)(e,t?.replacer,r.indent);return r.whitespace.start+i+r.whitespace.end}

37},

39};

Long lines were clipped for display.

dist/mcp-server.jsView file

•path = dist/mcp-server.js kind = oversized_source_file sizeBytes = 2493170 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.jsView on unpkg

•path = dist/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 2493170 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp-server.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/913.jsView file

21contains invisible/control Unicode U+FEFF (zero width no-break space) `?(c++,l=0):e?l+=e.length:l++,e&&(s+=e.length),e}let S={default(){switch(v){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case`<U+FEFF>`:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/913.jsView on unpkg · L21

dist/mcp-server.jsView file

•path = dist/mcp-server.js kind = oversized_source_file sizeBytes = 2493170 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.jsView on unpkg

•path = dist/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 2493170 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp-server.jsView on unpkg

Findings

1 Critical1 High5 Medium6 Low

CriticalTrojan Source Unicodedist/913.js

HighOversized Source Filedist/mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/mcp-server.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/913.jsView file

Lines 1-40javascript

1export const __rspack_esm_id = 913;

2export const __rspack_esm_ids = [913];

3export const __webpack_modules__ = {

42576(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {

6// EXPORTS

7__webpack_require__.d(__webpack_exports__, {

8 parseJSON5: () => (/* binding */ json5_s)

9});

11// UNUSED EXPORTS: stringifyJSON5

13// EXTERNAL MODULE: external "node:module"

14var external_node_module_ = __webpack_require__(8995);

15;// CONCATENATED MODULE: ../../node_modules/confbox/dist/_chunks/rolldown-runtime.mjs

17// EXTERNAL MODULE: ../../node_modules/confbox/dist/_chunks/_format.mjs

18var _format = __webpack_require__(5492);

19;// CONCATENATED MODULE: ../../node_modules/confbox/dist/_chunks/libs/json5.mjs

21`?(c++,l=0):e?l+=e.length:l++,e&&(s+=e.length),e}let S={default(){switch(v){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case``:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/913.jsView on unpkg · L21

25`;case`r`:return x(),`\r`;case`t`:return x(),` `;case`v`:return x(),`\v`;case`0`:if(x(),r.isDigit(b()))throw j(x());return`\0`;case`x`:return x

26`:case`\u2028`:case`\u2029`:return x(),``;case`\r`:return x(),b()===`

27`&&x(),``;case`1`:case`2`:case`3`:case`4`:case`5`:case`6`:case`7`:case`8`:case`9`:throw j(x());case void 0:throw j(x())}return x()}function E(){

28`+a;e=r.join(n),s=`{

29`+a+e+`,

31`+a,i=n.join(e);r=`[

32`+a+i+`,

33`+t+`]`}return i.pop(),a=t,r}}}));

34;// CONCATENATED MODULE: ../../node_modules/confbox/dist/json5.mjs

37},

39};

Long lines were clipped for display.

dist/mcp-server.jsView file

•path = dist/mcp-server.js kind = oversized_source_file sizeBytes = 2493170 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.jsView on unpkg

•path = dist/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 2493170 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp-server.jsView on unpkg