registry / @mindflight/ghostcrab-personal-mcp / 0.7.4

@mindflight/ghostcrab-personal-mcp@0.7.4

SQLite-backed MCP memory server (MindBrain + Zig backend), part of the MindBrain ecosystem.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The postinstall automatically adds or refreshes this package's MCP server entry in existing user-level Cursor and Codex configuration. The changes are scoped to Ghostcrab entries, so the evidence supports a warning for first-party agent integration rather than a broad control hijack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation, after a successful prebuild, unless the upgrade step is skipped by its environment setting.

Impact

The IDE configuration gains an automatic registration for this package's MCP server. The inspected path does not change unrelated MCP entries or grant broad permissions.

Mechanism

The hook runs the upgrade routine, which replaces matching Ghostcrab entries in existing Cursor and Codex MCP configuration with an entry that launches this package.

AI rationale

Evidence

package.jsonbin/lib/postinstall-prebuilds.mjsbin/lib/install-upgrade.mjs~/.cursor/mcp.json~/.codex/config.toml

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs a postinstall hook. After a successful prebuild, the hook calls the upgrade routine with configuration cleanup enabled and dry-run disabled.
The upgrade routine refreshes Cursor and Codex MCP configuration during its normal run.
For an existing Cursor MCP file, the routine removes Ghostcrab-related entries and adds this package's own server entry; it leaves a missing file alone.
For Codex, the routine filters Ghostcrab MCP sections and writes the updated configuration with a backup.
The other flagged locations are setup helpers for skill paths, MCP registration, and permissions, separate from the postinstall upgrade path.

Evidence against

The automatic changes are limited to this package's Ghostcrab MCP entries; the inspected code does not grant broad agent permissions or rewrite unrelated MCP entries.
The postinstall integration runs only after a successful prebuild and can be skipped with an environment setting.

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Source & flagged code

15 flagged

package.jsonView file

Lines 52-92json

52 "docs/dev/npm_split_release_process.md",

53 "docs/dev/workspace-model-export.schema.json",

54 "docs/dev/examples/*.export.json",

55 "docs/installers",

56 "docs/posts/*.md",

57 "docs/reference",

58 "docs/setup",

59 "examples/ghostcrab-docs",

60 "examples/immeuble/contracts/qualified_projections.json",

61 "examples/node-stdio-client",

62 "README.md",

63 "INSTALL.md",

64 "Licence.md",

65 ".env.example"

66 ],

67 "packageManager": "pnpm@10.10.0",

68 "engines": {

69 "node": ">=20.0.0"

70 },

71 "scripts": {

72 "postinstall": "node ./bin/lib/postinstall-prebuilds.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L72

73 "build": "node scripts/clean-dist.mjs && tsc --project tsconfig.json && node scripts/copy-sql.mjs && node scripts/sync-ide-skill-bundles.mjs",

74 "sync:ide-skills": "node scripts/sync-ide-skill-bundles.mjs",

75 "clean": "rm -rf coverage dist",

76 "dev": "tsx src/index.ts",

77 "demo:load": "tsx src/cli/demo-load.ts",

78 "benchmark:graphrag": "python3 benchmarks/graphrag/run.py",

79 "test:graphrag": "python3 -m unittest discover -s benchmarks/graphrag/tests -v",

80 "demo:load:immeuble": "tsx src/cli/demo-load.ts --profile-file examples/immeuble/contracts/answer_artifacts.seed.jsonl",

81 "backend:ensure-vendor": "scripts/ensure-vendor.sh",

82 "backend:sqlite3": "scripts/download-sqlite3.sh",

83 "backend:build": "sh scripts/backend-build-full.sh",

84 "prebuild:all": "sh scripts/prebuilds-all.sh",

85 "prebuild:local": "pnpm run prebuild:all",

86 "prebuild:stage-packages": "node scripts/stage-platform-packages.mjs",

87 "backend:build:debug": "cd cmd/backend && ZIG_LOCAL_CACHE_DIR=\"${ZIG_LOCAL_CACHE_DIR:-/tmp/ghostcrab-zig-local-cache}\" ZIG_GLOBAL_CACHE_DIR=\"${ZIG_GLOBAL_CACHE_DIR:-/tmp/ghostcrab-zig-global-cache}\" \"${ZIG:-zig}\" build",

88 "backend:dev": "GHOSTCRAB_BACKEND_ADDR=:8091 GHOSTCRAB_SQLITE_PATH=data/ghostcrab.sqlite cmd/backend/zig-out/bin/ghostcrab-backend",

89 "smoke:backend": "scripts/smoke-backend.sh",

90 "embeddings:backfill": "tsx src/cli/embeddings-backfill.ts",

91 "format": "prettier --write .",

92 "format:check": "prettier --check .",

bin/lib/prebuild-permissions.mjsView file

Lines 1-31javascript

1/**

2 * Cross-platform prep for the native backend.

3 *

4 * Resolution order:

5 * - platform optionalDependency package when installed

6 * - local prebuilds/{platform-key}/ fallback for dev builds

7 *

8 * - Linux / macOS: ensure POSIX execute bit (npm/pnpm often strip +x on unpack).

9 * - macOS: try to clear Gatekeeper quarantine (downloaded / browser-copied toolchains).

10 * - Windows: .exe is run directly; no chmod (nothing to do here).

bin/lib/sqlite-file-count.mjsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

3const require = createRequire(import.meta.url);

4let cachedDatabaseSync = null;

dist/tools/business-query-learning/register-proposal.jsView file

Lines 229-260javascript

229 AND (

230 json_extract(facets_json, '$.capability_id') = ?

231 OR json_extract(facets_json, '$.proposal_fingerprint') = ?

232 )

bin/lib/path-shim.mjsView file

Lines 3-43javascript

3 * Installs a wrapper under ~/.ghostcrab/bin (or %USERPROFILE%\.ghostcrab\bin).

4 */

5import {

6 appendFileSync,

7 chmodSync,

8 existsSync,

bin/commands/serve.mjsView file

Lines 294-334javascript

294 }

295 }

296 } catch {

297 /* unreadable PID file, ignore */

298 }

299 }

300

301 // ── Port selection (only when not reusing an existing backend) ────────────

302 if (!

bin/lib/install-upgrade.mjsView file

Lines 1-23javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import {

4 copyFileSync,

5 existsSync,

6 mkdirSync,

7 readFileSync,

bin/lib/mcp-permissions-adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. me( (name) => e.startswith(`${name}:`) || e === `${name}:*` ); }); } export function mergeclaudesettingspermissions(existing, patch, opts = {}) { const servernames = opts.servernames ?? [ "ghostcrab-personal-mcp", "ghostcrab" ]; const base = existing && typeof existing === "object" ? { ...existing } : {}; const permissions = base.permissions && typeof base.permissions === "object" ? { ... (base.permissions) }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/mcp-permissions-adapters.mjsView on unpkg

docs/installers/beta-bundle/MakefileView file

•path = docs/installers/beta-bundle/Makefile kind = build_helper sizeBytes = 5120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docs/installers/beta-bundle/MakefileView on unpkg

bin/lib/install-upgrade.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lib/install-upgrade.mjs#virtual:normalized:round1View on unpkg

bin/lib/brain-engine-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.9 matchedPath = bin/lib/brain-engine-runner.mjs matchedIdentity = npm:[redacted]:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/brain-engine-runner.mjsView on unpkg

bin/lib/mcp-global-setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @mindflight/ghostcrab-personal-mcp@0.6.9 matchedPath = bin/lib/mcp-global-setup.mjs matchedIdentity = npm:[redacted]:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/mcp-global-setup.mjsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/lib/postinstall-prebuilds.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/lib/prebuild-permissions.mjsView file

11*/ L12: import { spawnSync } from "node:child_process"; L13: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/lib/prebuild-permissions.mjsView on unpkg · L11

bin/lib/sqlite-file-count.mjsView file

2L3: const require = createRequire(import.meta.url); L4: let cachedDatabaseSync = null;

Findings

1 Critical10 High6 Medium7 Low

CriticalAi Agent Control Hijackbin/lib/install-upgrade.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/lib/prebuild-permissions.mjs

HighSame File Env Network Executionbin/commands/serve.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/lib/mcp-permissions-adapters.mjs

HighTrigger Reachable Persistencebin/lib/path-shim.mjs

HighSemantic Analysis Limitedbin/lib/install-upgrade.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritybin/commands/serve.mjs

HighKnown Malware Source Similaritybin/lib/brain-engine-runner.mjs

HighKnown Malware Source Similaritybin/lib/mcp-global-setup.mjs

Affected versions and remediation

This report applies to @mindflight/ghostcrab-personal-mcp@0.7.4.

See all versions of @mindflight/ghostcrab-personal-mcp for other recorded verdicts.

Review the evidence and your use of @mindflight/ghostcrab-personal-mcp@0.7.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 13:12:44.039Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.