registry / @morphllm/morphmcp / 0.8.210

@morphllm/morphmcp@0.8.210

Fast & accurate MCP server with AI-powered file editing and intelligent code search. Prevents context pollution and saves time for a better user experience.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed unconsented attack surface. Runtime MCP tools read selected workspace files and send requested work to Morph API services; edits are invoked through the edit_file tool.

Static reason

One or more suspicious static signals were detected.

Trigger

User starts morph-mcp and invokes an MCP tool.

Impact

Selected project content may be processed by Morph services; requested edits may modify selected files.

Mechanism

User-invoked remote code editing and code-context search.

Rationale

The obfuscation is concerning but source inspection shows a package-aligned MCP server whose network, file-read, and edit operations require runtime tool use. No install-time execution or concrete malicious chain was found.

Evidence

package.jsondist/index.jsdist/logger.jsdist/roots-utils.jsdist/path-validation.js

Network endpoints2

api.morphllm.commorphllm.com/api/error-report

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

@morphllm/morphmcp@0.8.210

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code