registry / @manehorizons/cadence-core / 1.43.0

@manehorizons/cadence-core@1.43.0

CADENCE engine — the DRAFT→BUILD→SETTLE loop, configurable quality gates, and the host-agnostic `cadence` CLI for AI-assisted development.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package provides explicit CLI setup commands that can write project-local CADENCE, agent-document, and MCP configuration files, and can invoke package-aligned host installers after user selection or confirmation.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `cadence init`, `cadence mcp install`, or doctor repair actions.

Impact

Project-local configuration and documentation may be created or updated; no install-time execution, credential exfiltration, or stealth persistence was found.

Mechanism

Explicit project setup, MCP registration, and host-installer subprocess invocation.

Rationale

Source inspection shows a user-invoked development CLI with explicit, project-scoped AI-agent/MCP setup behavior, not unconsented install-time mutation or a concrete malicious chain. No harvesting, exfiltration, remote payload execution, or stealth persistence was found.

Evidence

package.jsonbin/cadence.cjsdist/cli/index.jsdist/cli/commands/init.jsdist/cli/commands/mcp.jsdist/mcp/install.jsdist/doctor/fix.jsdist/doctor/run.js<repo>/.cadence<repo>/AGENTS.md<repo>/CLAUDE.md<repo>/.mcp.json

@manehorizons/cadence-core@1.43.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code