@mindrian_os/cli@2.0.0-beta.51
Install MindrianOS into Claude Code with one command -- `npx @mindrian_os/cli`. Ships the MindrianOS plugin (Larry + PWS methodology + Data Room) plus a setup/diagnostics CLI (install/doctor/update).
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package silently registers installations on the first keyless Brain consult, sending a random identifier to its Brain service and persisting the returned token. This is not credential theft, but the undisclosed runtime identifier exchange warrants a telemetry warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A Brain tool is consulted while no Brain key is available; registration can be disabled with MINDRIAN_DISABLE_AUTO_REGISTER.
Impact
The service can distinguish this installation across its Brain requests; the runtime registration is not described in the reviewed package manifest or README search.
Mechanism
The client sends a random UUID to the service's /register endpoint, receives a token, and writes it to ~/.mindrian-install.json.
AI rationale
The package silently registers installations on the first keyless Brain consult, sending a random identifier to its Brain service and persisting the returned token. This is not credential theft, but the undisclosed runtime identifier exchange warrants a telemetry warning.
Evidence
lib/core/brain-client.cjsbin/mindrian-brain-mcp-client.cjs~/.mindrian-install.json
Network endpoints1
theo-mcp.onrender.com/register
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Brain client describes a one-shot registration as silent and disables it only when MINDRIAN_DISABLE_AUTO_REGISTER is set.
- The registration attempt is reached when a Brain consult has no key, including through the MCP client's availability gate.
- Registration sends a randomly generated install ID to /register and saves the returned token in ~/.mindrian-install.json.
- The default Brain endpoint is theo-mcp.onrender.com; MINDRIAN_BRAIN_URL can override it.
Evidence against
- The manifest declares no install, preinstall, or postinstall hook; its scripts are ordinary named commands.
- The registration is tied to a Brain consult, and the ID is randomly generated rather than derived from host, user, project, or credential data.
- The package's stated purpose includes a Brain API integration, and the endpoint is its configured Brain service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
11 flaggedbin/cli.jsView file
40L41: const { spawnSync } = require('node:child_process');
L42: const path = require('node:path');
High
54// 'claude' directly fails with ENOENT even when `claude --version` works in the
L55: // user's interactive shell. Routing through the shell (cmd.exe) on win32 lets
L56: // PATHEXT resolve the `.cmd` shim. POSIX is unaffected -- shell stays false there.
High
bin/mindrian-brain-mcp-client.cjsView file
32L33: const path = require('path');
L34:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/mindrian-brain-mcp-client.cjsFindings
1 Critical6 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltalib/core/brain-client.cjs
HighChild Processbin/cli.js
HighShellbin/cli.js
HighSame File Env Network Executionscripts/check-version-and-sha.cjs
HighCommand Output Exfiltrationscripts/generate-snapshot.cjs#virtual:normalized:round1
HighRuntime Package Installscripts/doctor.cjs
HighSemantic Analysis Limitedlib/brain/curation-batch.cjs#virtual:normalized:round1
MediumDynamic Requirebin/mindrian-brain-mcp-client.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/run-hook.cmd
MediumOversized Source File
Affected versions and remediation
This report applies to @mindrian_os/cli@2.0.0-beta.51.
See all versions of @mindrian_os/cli for other recorded verdicts.
- Review the evidence and your use of @mindrian_os/cli@2.0.0-beta.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.