@noclaf/mcp
MCP server e CLI pra controlar o NOS (Noclaf Operation System) a partir de assistentes de IA como Claude Code, Codex CLI e GitHub Copilot.
This report shows the evidence for @noclaf/mcp@0.3.6. 1 of 5 known versions is blocked or flagged. The newest version, 0.3.7, is flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiAlthough much of the behavior is package-aligned and documented, the default MCP-server startup path performs unconsented AI-agent control-surface writes from a remote-controlled vault/fallback bundle. Under the firewall decision boundary, that is concrete enough to block as AI-agent control hijack risk. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Decision evidence
public snapshot- dist/mcp-server.js runs auto-pull on MCP server startup unless NOCLAF_AUTO_PULL is 0/false.
- dist/mcp-server.js chooses claudeTarget or codexTarget from NOCLAF_CLIENT and calls pullVault after server connect.
- dist/lib/vault-source.js fetches approved ai_vault_docs from Supabase and falls back to bundled docs.
- dist/lib/provision.js writes/prunes commands, skills, and agents under the target agent directory with a manifest.
- dist/lib/targets.js maps Claude to ~/.claude and Codex to ~/.codex skills/prompts.
- dist/constants.js hardcodes Supabase host and token-exchange endpoint for remote vault/auth.
- package.json has no install/postinstall lifecycle hook; prepublishOnly is publisher-side build only.
- Credential handling is user-invoked login/env PAT and exchanges only with the package's Supabase service.
- dist/lib/dependencies.js avoids shell interpolation and only runs dependency installs after CLI confirmation or -y.
- Bundled skills/commands are visible markdown, mostly workflow/spec helpers, not hidden payloads.
Source & flagged code
3 flagged · loading sourcePackage contains a critical-looking secret pattern.
dist/constants.jsView on unpkg · L4Supabase service role key (JWT) in dist/constants.js
dist/constants.jsView on unpkg · L4This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsFindings
Affected versions and remediation
This report applies to @noclaf/mcp@0.3.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing @noclaf/mcp@0.3.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.