registry / @pagespace/cli / 0.1.1

@pagespace/cli@0.1.1

pagespace — the official CLI for PageSpace: browser-based login, drive/page/task management, and a `pagespace mcp` stdio server for coding agents.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `pagespace mcp` or `pagespace-mcp` and a connected MCP client calls a tool.

Impact

A connected client using the user's PageSpace credentials may perform permitted remote PageSpace changes.

Mechanism

Authenticated PageSpace API/MCP command dispatch.

Rationale

The package is not concretely malicious, but its explicit MCP and agent-management capabilities create delegated AI-agent risk when connected to an untrusted client. This warrants a warning rather than a publication block.

Evidence

package.jsondist/bin.jsdist/bin-pagespace-mcp.jsdist/mcp/serve.jsdist/commands/agents.jsdist/credentials/file-store.jsdist/config/resolve.js~/.pagespace/credentials.json

Network endpoints1

pagespace.ai

Decision evidence

public snapshot

@pagespace/cli@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code