@mnemom/mnemom@0.17.17

Transparent AI agent tracing

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The manifest's only lifecycle hook is a prepublish build, and the flagged runtime behavior is tied to explicit CLI use. Inspected configuration, process, and proxy code does not establish concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the CLI agent, login, or goal commands.

Impact

The inspected behavior does not establish credential theft, unconsented configuration mutation, or another attack surface.

Mechanism

The agent launch can wrap a user's Claude status-line command, while the remote-control feature routes requests through a local proxy and removes the OAuth bearer before gateway forwarding.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes CLI commands and a prepublish build hook, with no install lifecycle hook.
The agent command reads Claude settings in the context of an invoked launch; the flagged location does not itself write configuration.
The status-line code reads existing Claude settings and wraps a user command only when the agent launch requests it; users can opt out or skip wrapping when they pass their own settings.
Automatic version installation requires auto update mode and a valid stable version floor.
OAuth uses a non-shell process call to open the login URL; token requests go to the discovered authorization server endpoint.
The remote-control proxy strips the OAuth bearer before forwarding the gateway request; goal commands use an injected fetch and confirmation prompt.

Evidence against

The proxy handles credentials and forwards requests to the Mnemom gateway, but inspected code removes the OAuth bearer from that forwarding path.
The scanner flags configuration reads and subprocess use, but inspected status-line and OAuth behavior is tied to an invoked CLI feature.

Behavioral surface

Source & flagged code

6 flagged

dist/lib/update/min-version.jsView file

Lines 1-26javascript

1/**

2 * Turn the server's minimum-CLI hard-fail (lib/version-gate.ts) into a

3 * one-retry fix: when update.mode is auto and this install can update itself,

4 * install the newest stable release satisfying the floor, in the foreground,

5 * and ask the user to re-run. Synchronous because the gate is.

6 */

7import { spawnSync } from "node:child_process";

8import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

9import { CLI_VERSION } from "../../version.js";

10import { classifyInstall } from "./install-method.js";

11import { isValidVersion, isPrerelease } from "./semver.js";

12import { acquireLock, loadUpdateState } from "./state.js";

13import { entryRealpath, loadUpdatePrefs, npmInvocation } from "./system.js";

14/**

15 * Returns true when the CLI was upgraded. Only in `auto` mode — `notify` means

16 * "never install without my say-so", even for a server floor. The floor is

17 * untrusted header input: it must be a plain release version before it goes

18 * anywhere near argv. Another installer holding the lock → don't race it.

19 */

20export function upgradeToFloor(floor, deps) {

21 if (!isValidVersion(floor) || isPrerelease(floor))

22 return false;

23 if (deps.settings().mode !== "auto")

24 return false;

25 if (!canSelfUpdate(deps.method()))

26 return false;

dist/lib/oauth.js#virtual:normalized:round1View file

310* Windows path deliberately uses `rundll32 url.dll,FileProtocolHandler` rather L311: * than `cmd /c start`, because cmd.exe re-parses its command line and would L312: * interpret `&`, `|`, `^` etc. inside the URL (OAuth query strings always

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L310

dist/rc-proxy.mjsView file

Lines 62-103javascript

62// MNEMOM_AGENT_RC_DOOR gateway door URL (required), e.g. https://gateway.mnemom.ai/anthropic

63// MNEMOM_AGENT_RC_AGENT x-mnemom-agent value (required)

64// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

65// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

66// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

67// the gateway infers the goal from the user's messages)

68// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

69// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

70// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

dist/commands/agent.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l or remote-control shape."); } args = ["remote-control", "--name", rcname, ...passthrough]; if (ctx.handoffmcpconfigpath) args.push("--mcp-config", ctx.handoffmcpconfigpath); say(`mnemom agent: remote-control: headless server (session name '${rcname}'); drive the sessions it spawns from claude.ai/code or the claude app. stop this command to stop the server.`

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/agent.jsView on unpkg

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged · loading source

dist/lib/update/min-version.jsView file

6*/ L7: import { spawnSync } from "node:child_process"; L8: import { canSelfUpdate, PACKAGE_NAME, resolveSettings, } from "./decide.js";

High

Child Process

Package source references child process execution.

dist/lib/update/min-version.jsView on unpkg · L6

dist/lib/oauth.js#virtual:normalized:round1View file

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L310

dist/rc-proxy.mjsView file

Findings

6 High2 Medium5 Low

HighChild Processdist/lib/update/min-version.js

HighShelldist/lib/oauth.js#virtual:normalized:round1

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/agent.js

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.17.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 15:23:39.113Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.