Loading npm security reports…

@myelixlabs/synapse-mcp@3.0.4: AI-agent control-surface risk | LPM Firewall

registry / @myelixlabs/synapse-mcp / 3.0.4

@myelixlabs/synapse-mcp@3.0.4

CLI orchestrator for Synapse MCP — the structural brain for your AI editor.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall downloads a launcher and silently mutates an existing Gemini agent-instruction file. The mutation constrains future agent behavior to the package-controlled Synapse MCP server.

Static reason

One or more suspicious static signals were detected.

Trigger

Automatic npm postinstall for @myelixlabs/synapse-mcp@3.0.4 when ~/.gemini/config exists.

Impact

Hijacks Gemini-agent discovery policy and suppresses normal local inspection tools.

Mechanism

silent foreign AI-agent instruction injection after launcher download

Policy narrative

The postinstall hook invokes the quiet installer. After downloading a launcher, lib/install.js detects an existing ~/.gemini/config directory and appends a mandatory “MCP-First Discovery Policy” to AGENTS.md without consent or notice. That policy requires the Synapse MCP server for initial research and explicitly forbids rg, ls, find, grep_search, and manual file reading, altering a foreign AI-agent control surface. The downloaded pinned launcher is executed for a version probe without a manifest SHA-256 verification value.

Rationale

This is concrete, unconsented install-time mutation of a foreign AI-agent control surface, not an explicit user-command setup. The silent policy injects package-controlled tool preference and disables ordinary inspection paths.

Evidence

package.jsonbin/synapse-mcp.jslib/install.js~/.synapse-mcp/synapse-mcp~/.gemini/config/AGENTS.md

Network endpoints1

/synapse-mcp

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

44const os = require('node:os'); L45: const childProcess = require('node:child_process'); L46:

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L44

lib/service-os.jsView file

8* Linux → systemd user unit (~/.config/systemd/user/synapse-mcp.service) L9: * Windows → Task Scheduler (schtasks) L10: * ... L37: function homeDir(options) { L38: return options.homeDir || process.env.HOME || process.env.USERPROFILE || os.homedir(); L39: } ... L62: L63: function buildPlist(launcherPath, port, stdoutLog, stderrLog) { L64: return `<?xml version="1.0" encoding="UTF-8"?> ... L114: fs.writeFileSync(plist, buildPlist(launcher, port, stdoutLog, stderrLog)); L115: execSync(`launchctl load -w ${plist}`); L116:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/service-os.jsView on unpkg · L8

bin/synapse-mcp.js#virtual:normalized:round1View file

560return { L561: installDir: process.env.SYNAPSE_MCP_INSTALL_DIR || path.join(home, '.synapse-mcp'), L562: xdgConfigDir: process.env.XDG_CONFIG_HOME || path.join(home, '.config'), ... L574: // Backward compat: if 'fetch' is provided as an override it applies to cdnFetch L575: get fetch() { return this.cdnFetch; }, L576: spawnSync: child_process.spawnSync, L577: spawn: child_process.spawn,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L560

lib/install.jsView file

8* - Install dir: ~/.synapse-mcp/ L9: * - CDN base: https://downloads.synapse-mcp.dev/synapse-mcp L10: * - Supported platforms: darwin-aarch64, darwin-x86_64, linux-x86_64, ... L23: const crypto = require('node:crypto'); L24: const childProcess = require('node:child_process'); L25: const os = require('node:os'); ... L56: function platformId() { L57: if (process.platform === 'linux' && process.arch === 'x64') return 'linux-x86_64'; L58: if (process.platform === 'linux' && process.arch === 'arm64') return 'linux-aarch64'; ... L71: const baseUrl = options.baseUrl || L72: process.env.SYNAPSE_MCP_BASE_URL || L73: DEFAULT_BASE_URL;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/install.jsView on unpkg · L8

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/synapse-mcp.js install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/synapse-mcp.jsView file

Lines 24-64javascript

24 * repos add → repos.add()

25 * repos archive → repos.archive()

26 * repos restore → repos.restore()

27 * repos remove → repos.remove()

28 * repos reindex → repos.reindex()

29 * ui → startDashboard() + open browser

30 *

31 * Exported for testing:

32 * run(deps) — smart dispatch (no-args entry)

33 * runInstallWizard(deps) — full install wizard steps

34 *

35 * Why all external effects are injectable:

36 * The BDD first_run_wizard scenarios drive the entire orchestration without

37 * any real binary, real HTTP, or real OS calls by injecting stubs.

38 */

39

40'use strict';

41

42const fs = require('node:fs');

43const path = require('node:path');

44const os = require('node:os');

45const childProcess = require('node:child_process');

46

High

Child Process

Package source references child process execution.

bin/synapse-mcp.jsView on unpkg · L44

47// ─── Defaults ─────────────────────────────────────────────────────────────────

48

49const DEFAULT_API_BASE = 'https://api.synapse-mcp.dev';

50const DEFAULT_WEB_BASE = 'https://synapse-mcp.dev';

51const DEFAULT_DOWNLOADS = 'https://downloads.synapse-mcp.dev/synapse-mcp';

52const DEFAULT_SYNAPSE_PORT = 8585;

53const DEFAULT_DASH_PORT = 8686;

54const FREE_TIER_LIMIT = 3;

55

56// ─── Smart no-args dispatch ───────────────────────────────────────────────────

57

58/**

59 * Called when user runs `npx @myelixlabs/synapse-mcp` with no arguments.

60 * Detects state and either shows status or runs the wizard.

61 *

62 * @param {object} deps — injected dependencies (see makeDefaultDeps)

63 */

64async function run(deps = {}) {

lib/service-os.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * lib/service-os.js — OS-level autostart registration.

5 *

6 * Supports three platforms:

7 * macOS → launchd plist (~/Library/LaunchAgents/dev.synapse-mcp.plist)

8 * Linux → systemd user unit (~/.config/systemd/user/synapse-mcp.service)

9 * Windows → Task Scheduler (schtasks)

10 *

Medium

Install Persistence

bin/synapse-mcp.js#virtual:normalized:round1View file

560return { L561: installDir: process.env.SYNAPSE_MCP_INSTALL_DIR || path.join(home, '.synapse-mcp'), L562: xdgConfigDir: process.env.XDG_CONFIG_HOME || path.join(home, '.config'), ... L574: // Backward compat: if 'fetch' is provided as an override it applies to cdnFetch L575: get fetch() { return this.cdnFetch; }, L576: spawnSync: child_process.spawnSync, L577: spawn: child_process.spawn,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/synapse-mcp.js#virtual:normalized:round1View on unpkg · L560

lib/install.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * lib/install.js — binary download and integrity verification.

5 *

6 * Ported from sample_mcp/npm/lib/install.js and adapted for Synapse MCP:

7 * - Package name: synapse-mcp (not sample-mcp)

8 * - Install dir: ~/.synapse-mcp/

9 * - CDN base: https://downloads.synapse-mcp.dev/synapse-mcp

10 * - Supported platforms: darwin-aarch64, darwin-x86_64, linux-x86_64,

11