registry / @lovinka/deployik-mcp / 1.0.0

@lovinka/deployik-mcp@1.0.0

MCP server for Deployik — drive projects, deployments, secrets, and domains from any MCP-aware AI.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was found. The package does perform first-party MCP/Claude extension setup and optional launchd persistence when explicitly invoked by the user, so it carries agent extension lifecycle risk rather than blockable malware.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `deployik-mcp install`, `install-skill`, `install-mcp`, or `install --daemon`.

Impact

Adds Deployik tools/skills to Claude configs and may store a Deployik token in MCP config or a 0600 launchd plist.

Mechanism

explicit MCP config, skill install, and optional localhost daemon setup

Rationale

Because agent config and daemon persistence are explicit user-command functionality and package-aligned, this should not be publish-blocked. It should be warned as first-party agent extension lifecycle risk due to Claude config mutation and optional launchd persistence.

Evidence

package.jsondist/index.jsdist/install.jsdist/install-mcp.jsdist/install-skill.jsdist/install-daemon.jsdist/client/http.jsdist/daemon.jsdist/config/env.js~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%/Claude/claude_desktop_config.json~/.config/Claude/claude_desktop_config.json<cwd>/.mcp.json~/.claude/skills/deployik-howto/<cwd>/.claude/skills/deployik-howto/~/Library/LaunchAgents/com.lovinka.deployik-mcp.plist~/.deployik-mcp/runtime/~/Library/Logs/deployik-mcp.out.log~/Library/Logs/deployik-mcp.err.log

Network endpoints4

deployik.lovinka.com/api/health/api/auth/meconfigured DEPLOYIK_URL

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Explicit `install` command writes Claude MCP configs in `dist/install-mcp.js`.
Explicit `install-skill` writes Claude skill files in `dist/install-skill.js`.
Explicit `install --daemon` installs a macOS launchd service and rewrites Claude configs in `dist/install-daemon.js`.

Evidence against

`package.json` has no install/preinstall/postinstall lifecycle hooks; only `prepublishOnly`.
Default bin starts an MCP stdio server from `dist/index.js`; install mutations require user subcommands.
Network calls in `dist/client/http.js` and installer probes target configured Deployik URL with Bearer token.
Daemon binds to localhost by default and rejects non-local clients in `dist/daemon.js`.
No eval/vm/native binary loading or remote payload execution found.
Credential use is package-aligned: `DEPLOYIK_TOKEN` is sent only as Authorization to Deployik API or stored in explicit config/plist.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 343 KB of source, external domains: 10.x.x.x, 127.0.0.1, deployik.lovinka.com, lovinka.com, www.apple.com, www.google.com

Source & flagged code

2 flagged

dist/install-daemon.jsView file

Lines 1-28javascript

1// Install a long-lived deployik-mcp daemon via macOS launchd.

2//

3// The daemon (src/daemon.ts) is one HTTP process on 127.0.0.1, shared by

4// every Claude Code window. This module owns the install/uninstall side:

5//

6// 1. Write a launchd plist (~/Library/LaunchAgents/com.lovinka.deployik-mcp.plist)

7// that runs `node <absolute path>/dist/daemon.js` with KeepAlive=true,

8// RunAtLoad=true, and DEPLOYIK_* in EnvironmentVariables.

9// 2. Bootstrap it via `launchctl bootout` (clear any old version) +

10// `launchctl bootstrap gui/$UID <plist>`.

11// 3. Rewrite Claude configs: replace the old stdio entry

12// ({ command: "npx", args: [...], env: {...} }) with

13// ({ type: "http", url: "http://127.0.0.1:8788/mcp" }).

14// 4. Uninstall reverses all three.

15//

16// Token lives only in the plist's <EnvironmentVariables>. Plist file is

17// chmod 0600 — readable by the current user only. Other users on the box

18// would need root to read it.

19import { execFileSync } from "node:child_process";

20import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";

21import { homedir, platform } from "node:os";

22import { dirname, join, resolve } from "node:path";

23export const DAEMON_LABEL = "com.lovinka.deployik-mcp";

24export const DEFAULT_DAEMON_PORT = 8788;

25export const DEFAULT_URL = "https://deployik.lovinka.com";

26const MCP_NAME = "deployik";

27/** Where the staged daemon runtime lives — outside any TCC-protected folder. */

28function runtimeDir() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-daemon.jsView on unpkg · L8

•matchType = previous_version_dangerous_delta matchedPackage = @lovinka/deployik-mcp@1.0.1 matchedIdentity = npm:QGxvdmlua2EvZGVwbG95aWstbWNw:1.0.1 similarity = 0.938 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/install-daemon.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/install-daemon.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/install-daemon.jsView on unpkg

8// RunAtLoad=true, and DEPLOYIK_* in EnvironmentVariables. L9: // 2. Bootstrap it via `launchctl bootout` (clear any old version) + L10: // `launchctl bootstrap gui/$UID <plist>`. ... L12: // ({ command: "npx", args: [...], env: {...} }) with L13: // ({ type: "http", url: "http://127.0.0.1:8788/mcp" }). L14: // 4. Uninstall reverses all three. ... L18: // would need root to read it. L19: import { execFileSync } from "node:child_process"; L20: import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs"; ... L28: function runtimeDir() { L29: return join(homedir(), ".deployik-mcp", "runtime"); L30: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-daemon.jsView on unpkg · L8

Findings

1 High4 Medium5 Low

HighPrevious Version Dangerous Deltadist/install-daemon.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install-daemon.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/install-daemon.jsView file

Lines 1-28javascript

1// Install a long-lived deployik-mcp daemon via macOS launchd.

2//

3// The daemon (src/daemon.ts) is one HTTP process on 127.0.0.1, shared by

4// every Claude Code window. This module owns the install/uninstall side:

5//

6// 1. Write a launchd plist (~/Library/LaunchAgents/com.lovinka.deployik-mcp.plist)

7// that runs `node <absolute path>/dist/daemon.js` with KeepAlive=true,

8// RunAtLoad=true, and DEPLOYIK_* in EnvironmentVariables.

9// 2. Bootstrap it via `launchctl bootout` (clear any old version) +

10// `launchctl bootstrap gui/$UID <plist>`.

11// 3. Rewrite Claude configs: replace the old stdio entry

12// ({ command: "npx", args: [...], env: {...} }) with

13// ({ type: "http", url: "http://127.0.0.1:8788/mcp" }).

14// 4. Uninstall reverses all three.

15//

16// Token lives only in the plist's <EnvironmentVariables>. Plist file is

17// chmod 0600 — readable by the current user only. Other users on the box

18// would need root to read it.

19import { execFileSync } from "node:child_process";

20import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";

21import { homedir, platform } from "node:os";

22import { dirname, join, resolve } from "node:path";

23export const DAEMON_LABEL = "com.lovinka.deployik-mcp";

24export const DEFAULT_DAEMON_PORT = 8788;

25export const DEFAULT_URL = "https://deployik.lovinka.com";

26const MCP_NAME = "deployik";

27/** Where the staged daemon runtime lives — outside any TCC-protected folder. */

28function runtimeDir() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-daemon.jsView on unpkg · L8

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/install-daemon.jsView on unpkg