registry / @manehorizons/cadence-core / 1.46.0

@manehorizons/cadence-core@1.46.0

CADENCE engine — the DRAFT→BUILD→SETTLE loop, configurable quality gates, and the host-agnostic `cadence` CLI for AI-assisted development.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack surface is established. Explicit CLI setup can wire first-party Cadence integrations into project AI-agent configuration and persist local MCP trust grants.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `cadence init --host`, `cadence init --wire-host`, `cadence init --full`, or `cadence mcp install`.

Impact

Can add a project MCP entry, invoke a Cadence host installer, and persist local tool-trust grants in the selected repository.

Mechanism

Explicit AI-agent host and MCP configuration setup

Rationale

Inspected source shows no malicious install-time, import-time, exfiltration, destructive, or stealth-persistence chain. Flag as warn because explicit commands can configure AI-agent/MCP control surfaces and invoke external host installers.

Evidence

package.jsondist/init/host-wire.jsdist/cli/commands/init.jsdist/mcp/install.jsdist/mcp/trust/store.jsdist/verify/anthropic-verifier.js.mcp.jsonCLAUDE.mdAGENTS.md.cadence/mcp-trust.json

Decision evidence

public snapshot

@manehorizons/cadence-core@1.46.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code