registry / @mindflight/ghostcrab-personal-mcp / 0.7.3

@mindflight/ghostcrab-personal-mcp@0.7.3

SQLite-backed MCP memory server (MindBrain + Zig backend), part of the MindBrain ecosystem.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The verified concern is automatic lifecycle setup of this package’s own MCP server in Cursor and Codex. Its scope is limited to GhostCrab entries, so the evidence supports a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Package installation when native preparation succeeds and the install-upgrade skip flag is unset.

Impact

Cursor or Codex may launch this package’s server after installation without a separate setup command.

Mechanism

The postinstall helper runs the upgrade routine with config cleanup enabled, which refreshes GhostCrab entries to launch this package’s MCP server.

AI rationale

Evidence

package.jsonbin/lib/postinstall-prebuilds.mjsbin/lib/install-upgrade.mjs~/.cursor/mcp.json~/.codex/config.toml

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json configures a postinstall hook. When native preparation succeeds and the skip flag is unset, bin/lib/postinstall-prebuilds.mjs runs the upgrade helper without dry-run and with config cleanup enabled.
bin/lib/install-upgrade.mjs refreshes existing Cursor and Codex MCP configuration, registering this package’s own server to launch its `gcp brain up` command.
The refresh removes entries only when their keys or launch details identify GhostCrab; the registered server uses the package’s own key and has embeddings disabled.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 194 file(s), 1.49 MB of source, external domains: 127.0.0.1, api.acme.example, api.openai.com, my-internal-registry.example.com, openrouter.ai, registry.ghostcrab.io, telemetry.ghostcrab.be

Source & flagged code

14 flagged

package.jsonView file

Lines 52-92json

52 "docs/dev/npm_split_release_process.md",

53 "docs/dev/workspace-model-export.schema.json",

54 "docs/dev/examples/*.export.json",

55 "docs/installers",

56 "docs/posts/*.md",

57 "docs/reference",

58 "docs/setup",

59 "examples/ghostcrab-docs",

60 "examples/immeuble/contracts/qualified_projections.json",

61 "examples/node-stdio-client",

62 "README.md",

63 "INSTALL.md",

64 "Licence.md",

65 ".env.example"

66 ],

67 "packageManager": "pnpm@10.10.0",

68 "engines": {

69 "node": ">=20.0.0"

70 },

71 "scripts": {

72 "postinstall": "node ./bin/lib/postinstall-prebuilds.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L72

73 "build": "node scripts/clean-dist.mjs && tsc --project tsconfig.json && node scripts/copy-sql.mjs && node scripts/sync-ide-skill-bundles.mjs",

74 "sync:ide-skills": "node scripts/sync-ide-skill-bundles.mjs",

75 "clean": "rm -rf coverage dist",

76 "dev": "tsx src/index.ts",

77 "demo:load": "tsx src/cli/demo-load.ts",

78 "benchmark:graphrag": "python3 benchmarks/graphrag/run.py",

79 "test:graphrag": "python3 -m unittest discover -s benchmarks/graphrag/tests -v",

80 "demo:load:immeuble": "tsx src/cli/demo-load.ts --profile-file examples/immeuble/contracts/answer_artifacts.seed.jsonl",

81 "backend:ensure-vendor": "scripts/ensure-vendor.sh",

82 "backend:sqlite3": "scripts/download-sqlite3.sh",

83 "backend:build": "sh scripts/backend-build-full.sh",

84 "prebuild:all": "sh scripts/prebuilds-all.sh",

85 "prebuild:local": "pnpm run prebuild:all",

86 "prebuild:stage-packages": "node scripts/stage-platform-packages.mjs",

87 "backend:build:debug": "cd cmd/backend && ZIG_LOCAL_CACHE_DIR=\"${ZIG_LOCAL_CACHE_DIR:-/tmp/ghostcrab-zig-local-cache}\" ZIG_GLOBAL_CACHE_DIR=\"${ZIG_GLOBAL_CACHE_DIR:-/tmp/ghostcrab-zig-global-cache}\" \"${ZIG:-zig}\" build",

88 "backend:dev": "GHOSTCRAB_BACKEND_ADDR=:8091 GHOSTCRAB_SQLITE_PATH=data/ghostcrab.sqlite cmd/backend/zig-out/bin/ghostcrab-backend",

89 "smoke:backend": "scripts/smoke-backend.sh",

90 "embeddings:backfill": "tsx src/cli/embeddings-backfill.ts",

91 "format": "prettier --write .",

92 "format:check": "prettier --check .",

bin/lib/prebuild-permissions.mjsView file

Lines 1-31javascript

1/**

2 * Cross-platform prep for the native backend.

3 *

4 * Resolution order:

5 * - platform optionalDependency package when installed

6 * - local prebuilds/{platform-key}/ fallback for dev builds

7 *

8 * - Linux / macOS: ensure POSIX execute bit (npm/pnpm often strip +x on unpack).

9 * - macOS: try to clear Gatekeeper quarantine (downloaded / browser-copied toolchains).

10 * - Windows: .exe is run directly; no chmod (nothing to do here).

bin/lib/sqlite-file-count.mjsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

3const require = createRequire(import.meta.url);

4let cachedDatabaseSync = null;

dist/tools/business-query-learning/register-proposal.jsView file

Lines 229-260javascript

229 AND (

230 json_extract(facets_json, '$.capability_id') = ?

231 OR json_extract(facets_json, '$.proposal_fingerprint') = ?

232 )

bin/lib/path-shim.mjsView file

Lines 3-43javascript

3 * Installs a wrapper under ~/.ghostcrab/bin (or %USERPROFILE%\.ghostcrab\bin).

4 */

5import {

6 appendFileSync,

7 chmodSync,

8 existsSync,

bin/commands/serve.mjsView file

Lines 294-334javascript

294 }

295 }

296 } catch {

297 /* unreadable PID file, ignore */

298 }

299 }

300

301 // ── Port selection (only when not reusing an existing backend) ────────────

302 if (!

bin/lib/install-upgrade.mjsView file

Lines 1-23javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import {

4 copyFileSync,

5 existsSync,

6 mkdirSync,

7 readFileSync,

bin/lib/mcp-permissions-adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. me( (name) => e.startswith(`${name}:`) || e === `${name}:*` ); }); } export function mergeclaudesettingspermissions(existing, patch, opts = {}) { const servernames = opts.servernames ?? [ "ghostcrab-personal-mcp", "ghostcrab" ]; const base = existing && typeof existing === "object" ? { ...existing } : {}; const permissions = base.permissions && typeof base.permissions === "object" ? { ... (base.permissions) }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/mcp-permissions-adapters.mjsView on unpkg

docs/installers/beta-bundle/MakefileView file

•path = docs/installers/beta-bundle/Makefile kind = build_helper sizeBytes = 5120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docs/installers/beta-bundle/MakefileView on unpkg

bin/lib/brain-engine-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.9 matchedPath = bin/lib/brain-engine-runner.mjs matchedIdentity = npm:[redacted]:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/brain-engine-runner.mjsView on unpkg

bin/lib/mcp-global-setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.9 matchedPath = bin/lib/mcp-global-setup.mjs matchedIdentity = npm:[redacted]:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/lib/postinstall-prebuilds.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/lib/prebuild-permissions.mjsView file

11*/ L12: import { spawnSync } from "node:child_process"; L13: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/lib/prebuild-permissions.mjsView on unpkg · L11

bin/lib/sqlite-file-count.mjsView file

2L3: const require = createRequire(import.meta.url); L4: let cachedDatabaseSync = null;

Findings

1 Critical9 High6 Medium7 Low

CriticalAi Agent Control Hijackbin/lib/install-upgrade.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/lib/prebuild-permissions.mjs

HighSame File Env Network Executionbin/commands/serve.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/lib/mcp-permissions-adapters.mjs

HighTrigger Reachable Persistencebin/lib/path-shim.mjs

HighKnown Malware Source Similaritybin/lib/install-upgrade.mjs

HighKnown Malware Source Similaritybin/commands/serve.mjs

HighKnown Malware Source Similaritybin/lib/brain-engine-runner.mjs

HighKnown Malware Source Similaritybin/lib/mcp-global-setup.mjs

Affected versions and remediation

This report applies to @mindflight/ghostcrab-personal-mcp@0.7.3.

See all versions of @mindflight/ghostcrab-personal-mcp for other recorded verdicts.

Review the evidence and your use of @mindflight/ghostcrab-personal-mcp@0.7.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 13:00:04.541Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code