registry / AI-agent control-surface risk / @mindflight/ghostcrab-personal-mcp

@mindflight/ghostcrab-personal-mcp

SQLite-backed MCP memory server (MindBrain + Zig backend), part of the MindBrain ecosystem.

This report shows the evidence for @mindflight/ghostcrab-personal-mcp@0.6.9. 4 of 9 known versions are blocked or flagged. The newest version, 0.7.4, is flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is malicious under the install-control-surface policy because a postinstall hook automatically rewrites existing global Cursor and Codex agent configuration. The additional consumer-project mutations confirm broad automatic install-time modification.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation

Impact

The package gains an automatically registered MCP launch entry in existing agent clients and changes consumer-project contents without an explicit setup command.

Mechanism

automatic rewriting of AI-agent configuration and consumer-project bootstrap

Policy narrative

On npm installation, the postinstall script calls the upgrade routine without dry-run mode and enables configuration cleanup. The routine rewrites existing global Cursor and Codex MCP configuration to add this package as a launched MCP server. Separately, postinstall creates a consumer .env and data directory and adds documentation and skill symlinks. These are unconsented install-time mutations of AI-agent control surfaces and the consuming project.

AI rationale

Evidence

package.jsonbin/lib/postinstall-prebuilds.mjsbin/lib/install-upgrade.mjsbin/lib/postinstall-host-bootstrap.mjs~/.cursor/mcp.json~/.cursor/mcp.json.bak~/.codex/config.toml~/.codex/config.toml.bakconsumer-project/.envconsumer-project/dataconsumer-project/README.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs a postinstall script automatically.
Postinstall automatically invokes an upgrade routine with configuration cleanup enabled.
That routine rewrites existing global Cursor and Codex MCP configuration to launch this package.
Postinstall also creates consumer-project files and links without an explicit command.

Evidence against

No runtime dependency on this package's own name was found.
The reviewed configuration writes point to the package's own MCP server and no secret exfiltration endpoint was identified.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 192 file(s), 1.47 MB of source, external domains: 127.0.0.1, api.acme.example, api.openai.com, my-internal-registry.example.com, openrouter.ai, registry.ghostcrab.io, telemetry.ghostcrab.be

Source & flagged code

16 flagged

package.jsonView file

Lines 43-83json

43 "installations",

44 "docs/index.md",

45 "docs/architecture",

46 "docs/dev",

47 "docs/installers",

48 "docs/posts/*.md",

49 "docs/reference",

50 "docs/setup",

51 "examples/ghostcrab-docs",

52 "examples/node-stdio-client",

53 "README.md",

54 "INSTALL.md",

55 "Licence.md",

56 ".env.example"

57 ],

58 "packageManager": "pnpm@10.10.0",

59 "engines": {

60 "node": ">=20.0.0"

61 },

62 "scripts": {

63 "postinstall": "node ./bin/lib/postinstall-prebuilds.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L63

64 "build": "tsc --project tsconfig.json && node scripts/copy-sql.mjs && node scripts/sync-ide-skill-bundles.mjs",

65 "sync:ide-skills": "node scripts/sync-ide-skill-bundles.mjs",

66 "clean": "rm -rf coverage dist",

67 "dev": "tsx src/index.ts",

68 "demo:load": "tsx src/cli/demo-load.ts",

69 "benchmark:graphrag": "python3 benchmarks/graphrag/run.py",

70 "test:graphrag": "python3 -m unittest discover -s benchmarks/graphrag/tests -v",

71 "demo:load:immeuble": "tsx src/cli/demo-load.ts --profile-file examples/immeuble/contracts/answer_artifacts.seed.jsonl",

72 "backend:ensure-vendor": "scripts/ensure-vendor.sh",

73 "backend:sqlite3": "scripts/download-sqlite3.sh",

74 "backend:build": "sh scripts/backend-build-full.sh",

75 "prebuild:all": "sh scripts/prebuilds-all.sh",

76 "prebuild:local": "pnpm run prebuild:all",

77 "prebuild:stage-packages": "node scripts/stage-platform-packages.mjs",

78 "backend:build:debug": "cd cmd/backend && ZIG_LOCAL_CACHE_DIR=\"${ZIG_LOCAL_CACHE_DIR:-/tmp/ghostcrab-zig-local-cache}\" ZIG_GLOBAL_CACHE_DIR=\"${ZIG_GLOBAL_CACHE_DIR:-/tmp/ghostcrab-zig-global-cache}\" \"${ZIG:-zig}\" build",

79 "backend:dev": "GHOSTCRAB_BACKEND_ADDR=:8091 GHOSTCRAB_SQLITE_PATH=data/ghostcrab.sqlite cmd/backend/zig-out/bin/ghostcrab-backend",

80 "smoke:backend": "scripts/smoke-backend.sh",

81 "embeddings:backfill": "tsx src/cli/embeddings-backfill.ts",

82 "format": "prettier --write .",

83 "format:check": "prettier --check .",

bin/lib/prebuild-permissions.mjsView file

Lines 1-31javascript

1/**

2 * Cross-platform prep for the native backend.

3 *

4 * Resolution order:

5 * - platform optionalDependency package when installed

6 * - local prebuilds/{platform-key}/ fallback for dev builds

7 *

8 * - Linux / macOS: ensure POSIX execute bit (npm/pnpm often strip +x on unpack).

9 * - macOS: try to clear Gatekeeper quarantine (downloaded / browser-copied toolchains).

10 * - Windows: .exe is run directly; no chmod (nothing to do here).

bin/lib/install-upgrade.mjsView file

Lines 1-23javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import {

4 copyFileSync,

5 existsSync,

6 mkdirSync,

7 readFileSync,

bin/lib/sqlite-file-count.mjsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

3const require = createRequire(import.meta.url);

4let cachedDatabaseSync = null;

dist/tools/business-query-learning/register-proposal.jsView file

Lines 225-256javascript

225 AND (

226 json_extract(facets_json, '$.capability_id') = ?

227 OR json_extract(facets_json, '$.proposal_fingerprint') = ?

228 )

bin/lib/path-shim.mjsView file

Lines 3-43javascript

3 * Installs a wrapper under ~/.ghostcrab/bin (or %USERPROFILE%\.ghostcrab\bin).

4 */

5import {

6 appendFileSync,

7 chmodSync,

8 existsSync,

bin/commands/serve.mjsView file

Lines 294-334javascript

294 }

295 }

296 } catch {

297 /* unreadable PID file, ignore */

298 }

299 }

300

301 // ── Port selection (only when not reusing an existing backend) ────────────

302 if (!

bin/lib/mcp-permissions-adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. me( (name) => e.startswith(`${name}:`) || e === `${name}:*` ); }); } export function mergeclaudesettingspermissions(existing, patch, opts = {}) { const servernames = opts.servernames ?? [ "ghostcrab-personal-mcp", "ghostcrab" ]; const base = existing && typeof existing === "object" ? { ...existing } : {}; const permissions = base.permissions && typeof base.permissions === "object" ? { ... (base.permissions) }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/mcp-permissions-adapters.mjsView on unpkg

docs/installers/beta-bundle/MakefileView file

•path = docs/installers/beta-bundle/Makefile kind = build_helper sizeBytes = 5120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docs/installers/beta-bundle/MakefileView on unpkg

bin/lib/brain-engine-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.6 matchedPath = bin/lib/brain-engine-runner.mjs matchedIdentity = npm:[redacted]:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/brain-engine-runner.mjsView on unpkg

bin/lib/mcp-global-setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.8 matchedPath = bin/lib/mcp-global-setup.mjs matchedIdentity = npm:[redacted]:0.6.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.5 matchedIdentity = npm:[redacted]:0.6.5 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/lib/postinstall-prebuilds.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/lib/prebuild-permissions.mjsView file

11*/ L12: import { spawnSync } from "node:child_process"; L13: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/lib/prebuild-permissions.mjsView on unpkg · L11

bin/lib/install-upgrade.mjsView file

3import { L4: copyFileSync, L5: existsSync, L6: mkdirSync, L7: readFileSync, ... L9: unlinkSync, L10: writeFileSync L11: } from "node:fs"; ... L439: function copySqliteWithSidecars(dbPath, backupPath) { L440: mkdirSync(dirname(backupPath), { recursive: true }); L441: copyFileSync(dbPath, backupPath); L442: for (const suffix of ["-wal", "-shm"]) {

Findings

1 Critical11 High6 Medium7 Low

CriticalAi Agent Control Hijackbin/lib/install-upgrade.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/lib/prebuild-permissions.mjs

HighShellbin/lib/install-upgrade.mjs

HighSame File Env Network Executionbin/commands/serve.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/lib/mcp-permissions-adapters.mjs

HighTrigger Reachable Persistencebin/lib/path-shim.mjs

HighKnown Malware Source Similaritybin/lib/install-upgrade.mjs

HighKnown Malware Source Similaritybin/commands/serve.mjs

HighKnown Malware Source Similaritybin/lib/brain-engine-runner.mjs

High

Affected versions and remediation

This report applies to @mindflight/ghostcrab-personal-mcp@0.6.9.

The versions list below shows the verdict for each recorded version.

Avoid installing @mindflight/ghostcrab-personal-mcp@0.6.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-14 07:52:50.805Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

0.7.4latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 1:07 PM 0.7.3SuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 12:51 PM 0.7.2Scan Failed—AllowUnder ReviewSep 14, 2026, 4:52 PM 0.7.1SuspiciousAgent extension lifecycle riskWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code