@noclaf/mcp@0.3.6

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Starting the noclaf-mcp MCP server after it is configured in an AI client.

Remote or bundled vault content can be installed into agent instruction surfaces without an explicit per-start user approval step; old managed files can also be pruned via manifest.

default runtime auto-pull of remote/bundled agent instructions into AI client directories

When an AI client launches noclaf-mcp, the server authenticates if possible, loads vault documents from Supabase or the bundle, then auto-provisions commands/skills/agents into Claude or Codex directories unless disabled by environment. This is a default runtime mutation of AI-agent instruction surfaces and can source content from a remote service.

Although much of the behavior is package-aligned and documented, the default MCP-server startup path performs unconsented AI-agent control-surface writes from a remote-controlled vault/fallback bundle. Under the firewall decision boundary, that is concrete enough to block as AI-agent control hijack risk. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.