registry / @m8t-stack/cli / 0.2.14
@m8t-stack/cli@0.2.14
CLI for managing m8t-stack deployments on Azure / Microsoft Agent Foundry
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a broad operator CLI with powerful but documented, user-triggered Azure/GitHub actions and no lifecycle execution, hidden exfiltration, persistence, destructive install behavior, or unconsented AI-agent control-surface mutation. Scanner findings are explained by package-aligned management features.
Static reason
One or more suspicious static signals were detected.
Trigger
Explicit m8t CLI subcommands such as brain link/create, deploy, bootstrap, eval, config, or team operations.
Impact
Can modify the user's configured Azure, GitHub, Foundry, and local m8t state when commands are intentionally run with credentials.
Mechanism
User-invoked Azure/GitHub management CLI with token use, repo writes, local config writes, and shelling out to required tools.
AI rationale
Static inspection shows a broad operator CLI with powerful but documented, user-triggered Azure/GitHub actions and no lifecycle execution, hidden exfiltration, persistence, destructive install behavior, or unconsented AI-agent control-surface mutation. Scanner findings are explained by package-aligned management features.
Evidence
package.jsonREADME.mddist/cli.js~/.m8t-stack/cli-config.yaml~/.m8t-stack/config.yaml~/.m8t-stack/github-app.pem~/.m8t-stack/github-app.json~/.m8t-stack/foundry/<agent>.yaml.m8t/brain.yamlapps/web/.env.local
Network endpoints7
api.github.commanagement.azure.comai.azure.comapi.githubcopilot.com/mcpghcr.iograph.microsoft.comapi.openai.com/v1
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js uses child_process spawn/spawnSync for az, gh, git, pnpm, brain-eval/brain-exam, and browser open commands.
- dist/cli.js reads Azure Key Vault GitHub App secrets and mints GitHub installation tokens.
- dist/cli.js user-invoked brain link/create writes .m8t/brain.yaml and deploys Foundry agent versions with MCP brain tooling.
Evidence against
- package.json has no install/postinstall/prepare hook; only prepublishOnly builds before publishing.
- dist/cli.js main only dispatches Clipanion CLI commands from argv; no import-time network or command execution beyond CLI startup registration.
- Network calls target package-aligned Azure, GitHub, GHCR, OpenAI SDK, Copilot MCP, and configured gateway endpoints for deployment/management workflows.
- Local file writes are expected CLI state/output such as ~/.m8t-stack configs, GitHub App creds, temp brain repos, eval outputs, and project env files.
- README.md documents the Azure/GitHub management purpose and local config paths matching source behavior.
Behavioral surface
ChildProcess
Source & flagged code
2 flagged · loading sourcedist/cli.jsView file
11448init_errors();
L11449: import { spawn } from "child_process";
L11450: function runAz(args) {
High
19448);
L19449: this.context.stdout.write(
L19450: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L19456: // src/commands/open.ts
L19457: import { spawn as spawn5 } from "child_process";
L19458: import { Command as Command42, Option as Option40 } from "clipanion";
...
L19462: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L19463: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L19464: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L19448Findings
3 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.14.
See all versions of @m8t-stack/cli for other recorded verdicts.
- Review the evidence and your use of @m8t-stack/cli@0.2.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.