registry / @ory/amp / 1.5.0

@ory/amp@1.5.0

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The package provides a first-party Amp extension installer that modifies Amp settings and adds a project plugin when explicitly run. These source-backed configuration changes warrant a warning, but no npm lifecycle trigger or concrete malicious behavior was established.

Static reason

No blocking static signals were detected.

Trigger

A user invokes the `ory-amp-setup` bin or the CLI setup command.

Impact

Amp can route tool permissions through the Ory delegate and load the package's plugin for authentication and auditing.

Mechanism

The command registers a delegate for all Amp tools in the user's settings and writes a project plugin loader.

AI rationale

Evidence

~/.config/amp/settings.json<projectDir>/.amp/plugins/ory.ts

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes setup as a command-line bin and defines no install lifecycle hook.
Running setup writes a global Amp permission delegate for all tools and a project plugin loader.
The loader and skills are package-owned Amp integration components; the setup command has an uninstall path.

Evidence against

The configuration changes are behind an explicit CLI setup command, not an npm install hook.
No unrelated dependency approval change or concrete attack behavior was identified in the inspected entrypoints.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

6 flagged

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

176const settingsPath = getSettingsPath(args); const pluginFile = getPluginFile(args); const skillsDir = path.join(args.projectDir, ".agents", "skills"); const existing = (0, ar

Medium

Ai Review Evidence

Running setup writes a global Amp permission delegate for all tools and a project plugin loader.

dist/cli/setup.jsView on unpkg · L176

208// (a) Register the permission delegate (blocking gate). const merged = mergePermissions(existing, runtime.hookShim); (0, argus_1.writeJsonFile)(settingsPath, merged); // (b) Write the in-process plugin loader (auth + activity auditin

Medium

Ai Review Evidence

Running setup writes a global Amp permission delegate for all tools and a project plugin loader.

dist/cli/setup.jsView on unpkg · L208

211// (b) Write the in-process plugin loader (auth + activity auditing). fs.mkdirSync(path.dirname(pluginFile), { recursive: true }); fs.writeFileSync(pluginFile, pluginLoaderSource(runtime))

Medium

Ai Review Evidence

Running setup writes a global Amp permission delegate for all tools and a project plugin loader.

dist/cli/setup.jsView on unpkg · L211

package.jsonView file

62"bin": { "ory-amp": "dist/cli/main.js", "ory-amp-permission": "dist/permission.js", "ory-amp-setup": "dist/cli/setup.js" }, "files": [ "dist", "!dist/**/*

Medium

Suspicious Lifecycle Evidence

The manifest exposes setup as a command-line bin and defines no install lifecycle hook.

package.jsonView on unpkg · L62

81"scripts": { "build": "tsc", "clean": "rm -rf dist *.tsbuildinfo", "test": "vitest run", "test:watch": "vitest", "typecheck": "tsc --noEmit" } }

Medium

Suspicious Lifecycle Evidence

The manifest exposes setup as a command-line bin and defines no install lifecycle hook.

package.jsonView on unpkg · L81

Source & flagged code

6 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

176const settingsPath = getSettingsPath(args); const pluginFile = getPluginFile(args); const skillsDir = path.join(args.projectDir, ".agents", "skills"); const existing = (0, ar

Medium

Ai Review Evidence

Running setup writes a global Amp permission delegate for all tools and a project plugin loader.

dist/cli/setup.jsView on unpkg · L176

Findings

1 High6 Medium3 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/cli/setup.js

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @ory/amp@1.5.0.

See all versions of @ory/amp for other recorded verdicts.

Review the evidence and your use of @ory/amp@1.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 04:27:59.162Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.