registry / @monadeo.com/grimoire-cli / 0.3.6

@monadeo.com/grimoire-cli@0.3.6

Grimoire CLI — version-correct documentation retrieval for AI coding agents

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `grimoire setup <claude-code|cursor|windsurf|codex>` or another CLI command.

Impact

The chosen agent is configured to launch `@monadeo.com/grimoire-mcp` through npx; no install-time or stealth mutation is present.

Mechanism

Explicit MCP configuration setup and package-aligned API/auth/update requests.

Rationale

Source inspection confirms explicit user-invoked AI-agent configuration mutation, which warrants a warning under the stated policy. The remaining network, token storage, and subprocess behavior is package-aligned and no concrete malware behavior was identified.

Evidence

package.jsondist/index.jsREADME.md$HOME/.claude.json$HOME/.cursor/mcp.json$HOME/.codeium/windsurf/mcp_config.json$HOME/.codex/config.toml$XDG_CONFIG_HOME/grimoire/credentials.json$XDG_CONFIG_HOME/grimoire/update-check.json.grimoire.json

Network endpoints3

grimoire-api.monadeo.com/@monadeo.com%2Fgrimoire-cli

@monadeo.com/grimoire-cli@0.3.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code