registry / @memnexus-ai/mx-agent-cli / 0.1.297
@memnexus-ai/mx-agent-cli@0.1.297
CLI for creating and managing AI agent teams
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe flagged subprocess, network, and agent-configuration behavior is consistent with the CLI’s project and coordination functions, with user-command triggers and source-level scope checks. I found no concrete attack behavior supporting a block or warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs commands such as init or start; the coordination request occurs on the queue-enabled start path.
Impact
No malicious impact was established; the inspected behavior supports project setup, guarded agent configuration, and coordination authentication.
Mechanism
The request validates the coordination URL before reading the user key, sends it to the credential endpoint, and rejects redirects. Agent files are written as part of project setup or session operations.
AI rationale
The flagged subprocess, network, and agent-configuration behavior is consistent with the CLI’s project and coordination functions, with user-command triggers and source-level scope checks. I found no concrete attack behavior supporting a block or warning.
Evidence
mx-agent.config.jsonmx-agent-system/agent-config/settings.json.claude/settings.json.claude/hooks/
Network endpoints2
coord.memnexus.ai/admin/credentiallocalhost:3100/v1/pr-sync
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares build-related lifecycle commands; it has no preinstall, install, or postinstall hook.
- Agent configuration writes are part of project setup and session commands; Codex deployment is scoped to a worktree, and guard proofs require existing hook trust.
- The coordination request reads the MemNexus key only after validating the URL. Its default host is under memnexus.ai, other hosts require a separate global allowlist entry, and redirects are rejected.
- The other flagged helpers perform project-scoped builds, behavioral-file checks, diagnostics, or PR metadata sync; inspected source did not establish malicious behavior.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/lib/fleet-data.jsView file
20import { join } from 'path';
L21: import { spawnSync } from 'child_process';
L22: import { listTeams } from './catalog.js';
High
Child Process
Package source references child process execution.
dist/lib/fleet-data.jsView on unpkg · L20dist/lib/vm-health.js#virtual:normalized:round1View file
101/** Drains swap immediately without a VM restart. Windows host, elevated shell. */
L102: export const SWAP_DRAIN_COMMAND = "wsl -d <distro> -u root sh -c \"swapoff -a && swapon -a\"";
L103: /**
High
Shell
Package source references shell execution.
dist/lib/vm-health.js#virtual:normalized:round1View on unpkg · L101dist/index.jsView file
Findings
3 Critical5 High5 Medium6 Low
CriticalEncoded Package Runner Executiondist/lib/cli-build.js
CriticalTrojan Source Unicodedist/lib/behavioral-injection.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/lib/behavioral-injection.js
HighChild Processdist/lib/fleet-data.js
HighShelldist/lib/vm-health.js#virtual:normalized:round1
HighSame File Env Network Executiondist/commands/pr-sync.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/init.js
HighSemantic Analysis Limiteddist/commands/codex-prove-guards.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.297.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.297 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.