registry / @pagespace/cli / 0.1.1

@pagespace/cli@0.1.1

pagespace — the official CLI for PageSpace: browser-based login, drive/page/task management, and a `pagespace mcp` stdio server for coding agents.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `pagespace mcp` or `pagespace-mcp` and a connected MCP client calls a tool.

Impact

A connected client using the user's PageSpace credentials may perform permitted remote PageSpace changes.

Mechanism

Authenticated PageSpace API/MCP command dispatch.

Rationale

The package is not concretely malicious, but its explicit MCP and agent-management capabilities create delegated AI-agent risk when connected to an untrusted client. This warrants a warning rather than a publication block.

Evidence

package.jsondist/bin.jsdist/bin-pagespace-mcp.jsdist/mcp/serve.jsdist/commands/agents.jsdist/credentials/file-store.jsdist/config/resolve.js~/.pagespace/credentials.json

Network endpoints1

pagespace.ai

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/mcp/serve.js` exposes authenticated MCP tools including deletes and `updateAgentConfig`.
`dist/commands/agents.js` explicitly updates remote PageSpace agent configuration.
`dist/credentials/file-store.js` persists refresh credentials at `~/.pagespace/credentials.json` with restrictive modes.

Evidence against

`package.json` has no npm lifecycle hooks.
Entrypoints only run when the user invokes the CLI or `pagespace-mcp`.
No eval, shell execution, payload download, or foreign AI-agent config writes were found.
Default network origin is the package-aligned `https://pagespace.ai`.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 182 KB of source, external domains: 127.0.0.1, pagespace.ai

Source & flagged code

3 flagged

dist/mcp/serve.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/mcp/serve.js` exposes authenticated MCP tools including deletes and `updateAgentConfig`.

dist/mcp/serve.jsView on unpkg

dist/commands/agents.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/commands/agents.js` explicitly updates remote PageSpace agent configuration.

dist/commands/agents.jsView on unpkg

dist/credentials/file-store.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/credentials/file-store.js` persists refresh credentials at `~/.pagespace/credentials.json` with restrictive modes.

Source & flagged code

3 flagged · loading source

dist/mcp/serve.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/mcp/serve.js` exposes authenticated MCP tools including deletes and `updateAgentConfig`.

dist/mcp/serve.jsView on unpkg

dist/commands/agents.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/commands/agents.js` explicitly updates remote PageSpace agent configuration.

dist/commands/agents.jsView on unpkg

dist/credentials/file-store.jsView file

•Published source reference

Medium

Ai Review Evidence

Findings

5 Medium4 Low

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencedist/mcp/serve.js

MediumAi Review Evidencedist/commands/agents.js

MediumAi Review Evidencedist/credentials/file-store.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

`dist/credentials/file-store.js` persists refresh credentials at `~/.pagespace/credentials.json` with restrictive modes.

dist/credentials/file-store.js

View on unpkg

460 KB · 231 files1 signature(s)

Install lifecycleNo install hooks · other: build, prepack, pretest, pretest:coverage +4

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

3 flagged

dist/mcp/serve.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/mcp/serve.js` exposes authenticated MCP tools including deletes and `updateAgentConfig`.

dist/mcp/serve.jsView on unpkg

dist/commands/agents.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/commands/agents.js` explicitly updates remote PageSpace agent configuration.

dist/commands/agents.jsView on unpkg

dist/credentials/file-store.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/credentials/file-store.js` persists refresh credentials at `~/.pagespace/credentials.json` with restrictive modes.

dist/credentials/file-store.js

View on unpkg