registry / @modootoday/datalab-extension-mcp / 0.0.3

@modootoday/datalab-extension-mcp@0.0.3

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit user-run installer persists this package as an MCP server in supported AI-agent clients or their configuration files. The runtime server listens only on a loopback address and relays MCP requests to the paired browser extension.

Static reason

No blocking static signals were detected.

Trigger

User runs `datalab-extension-mcp install` or `npx -y @modootoday/datalab-extension-mcp@0.0.3 install`.

Impact

Configured AI clients may later launch this package with the supplied pairing token; no unconsented install-time mutation is present.

Mechanism

Explicit MCP-agent registration and loopback browser-extension bridge.

Rationale

Not malicious by inspected source, but the explicit installer mutates AI-agent configuration and creates a persistent MCP integration. Per policy, this warrants a warning rather than a block.

Evidence

package.jsondist/cli.jsdist/dist-VJHTVTYX.jsdist/chunk-DXIOXXJK.js

Network endpoints1

127.0.0.1:8765

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

@modootoday/datalab-extension-mcp@0.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code