registry / @monadeo.com/grimoire-cli / 0.3.4

@monadeo.com/grimoire-cli@0.3.4

Grimoire CLI — version-correct documentation retrieval for AI coding agents

AI Security Review

scanned 11h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI's filesystem, network, and process capabilities are user-invoked product functions.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit `grimoire login`, `setup`, `init`, `update`, or API command invocation.

Impact

Writes package-owned credentials/config or selected agent MCP configuration only when requested; sends requested API data to Grimoire.

Mechanism

Authenticated documentation-service client with optional MCP setup and self-update.

Rationale

The flagged primitives implement documented, explicit CLI actions and package-aligned API authentication/update checks. There are no install-time hooks or concrete stealth, exfiltration, destructive, or remote-code-execution chain.

Evidence

package.jsondist/index.jsREADME.md~/.config/grimoire/config.json~/.config/grimoire/credentials.json~/.config/grimoire/update-check.json~/.codex/config.toml~/.claude.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json.grimoire.json

Network endpoints3

grimoire-api.monadeo.comregistry.npmjs.org/@monadeo.com%2Fgrimoire-cli

@monadeo.com/grimoire-cli@0.3.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code