registry / @planu/cli / 4.9.0

@planu/cli@4.9.0

Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package is an MCP/CLI developer tool, but MCP startup includes an unprompted global Claude Code keybinding write. Other risky primitives reviewed were package-aligned and mostly user-invoked.

Static reason

One or more suspicious static signals were detected.

Trigger

Starting the MCP server via dist/index.js or dist/cli/index.js with piped stdin

Impact

Changes ~/.claude/keybindings.json Chat bindings if absent; may alter how Enter and Shift+Enter submit prompts in Claude Code.

Mechanism

automatic AI-agent configuration mutation

Policy narrative

When used as an MCP server, @planu/cli performs post-handshake startup tasks and may automatically merge Planu-specific Chat keybindings into the user's global Claude Code keybindings file. This is not credential theft or malware persistence, but it is an unconsented AI-agent control-surface mutation outside the project workspace. A shipped hook template can also run git push when installed and fired, though installation appears tied to init_project/Claude detection rather than npm install.

Rationale

Source inspection did not confirm malware, exfiltration, install-time compromise, or hidden payload execution, but the automatic global Claude Code keybinding mutation is a real unresolved control-surface risk. Treat as warning rather than publish block because the mutation is visible, bounded, idempotent, and package-aligned, and most other risky behavior is user-invoked developer tooling.

Evidence

package.jsondist/index.jsdist/cli/index.jsdist/engine/claude-setup/keybindings-configurator.jsdist/config/hook-templates/planu-session-safeguard.shdist/engine/product-intelligence/index.jsdist/tools/rollback-release.jsdist/tools/auto-update-spec.jsdist/engine/auto-updater/config-patcher.js~/.claude/keybindings.json.claude/hooks/planu-spec-sanctity.sh.claude/logs/session-safeguard.log

Network endpoints2

registry.npmjs.org/-/package/@planu/cli/dist-tagscanusqigtzldstnjddio.supabase.co/rest/v1/telemetry_events

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for policy block

dist/index.js starts post-handshake startup work automatically in MCP mode.
dist/index.js imports configureClaudeKeybindings and calls it without an explicit tool request when global config says not configured.
dist/engine/claude-setup/keybindings-configurator.js writes ~/.claude/keybindings.json, adding Chat enter/shift+enter bindings.
dist/config/hook-templates/planu-session-safeguard.sh can push the current git branch when fired as a Claude hook.

Evidence against

package.json has no postinstall/install lifecycle; prepare is only husky || true.
dist/cli/index.js routes user CLI args or starts MCP server for piped stdin; no hidden install-time execution found.
dist/tools/rollback-release.js npm/npx child_process use is confined to rollback_release handler, not import-time.
dist/tools/auto-update-spec.js git diff is a user-invoked spec update helper.
dist/engine/product-intelligence/index.js queries a package-aligned Supabase telemetry table with an anon key, not credential harvesting.
dist/engine/auto-updater/config-patcher.js requires confirm=true before patching MCP config.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 2,729 file(s), 9.98 MB of source, external domains: agentskill.sh, api.anthropic.com, api.cloudflare.com, api.example.com, api.figma.com, api.github.com, api.linear.app, api.machines.dev, api.mistral.ai, api.netlify.com, api.notion.com, api.npmjs.org, api.nuget.org, api.openai.com, api.osv.dev, api.supabase.com, api.trello.com, api.vercel.com, app.mem0.ai, argocd-applicationset.readthedocs.io, azure.microsoft.com, backboard.railway.app, backstage.io, bentoml.com, bit.dev, canusqigtzldstnjddio.supabase.co, cdn.jsdelivr.net, chaos.cncf.io, checkstyle.sourceforge.io, clang.llvm.org, claude.ai, cloud.google.com, code.claude.com, commitlint.js.org, conftest.dev, containers.dev, cortex.io, cppcheck.sourceforge.io, crates.io, crossplane.io, cs.symfony.com, cursor.com, cyclonedx.org, daggerverse.dev, dart.dev, detekt.dev, developer.android.com, dl.dagger.io, doc.rust-lang.org, doc.traefik.io

Source & flagged code

14 flagged

dist/engine/product-intelligence/index.jsView file

Lines 1-27javascript

1// engine/product-intelligence/index.ts — SPEC-328: Product Intelligence Layer engine.

2// Queries Supabase telemetry_events to generate product insights reports.

3// Uses the same auth pattern as telemetry-client.ts (fire-and-forget-friendly).

4import { PLANU_VERSION } from '../../config/version.js';

5const SUPABASE_URL = process.env.PLANU_SUPABASE_URL ?? 'https://canusqigtzldstnjddio.supabase.co';

6const SUPABASE_KEY = process.env.PLANU_SUPABASE_KEY ??

7 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNhbnVzcWlndHpsZHN0bmpkZGlvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzI3NTk2MjgsImV4cCI6MjA4ODMzNTYyOH0.Thw1Xgf9_iabOD75J00u35d2k5NsIpUBU9PrqOShxMU';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/engine/product-intelligence/index.jsView on unpkg · L7

8const TELEMETRY_TABLE = `${SUPABASE_URL}/rest/v1/telemetry_events`;

9/** Core tools expected to be active — used for dead-tool detection. */

10const KNOWN_CORE_TOOLS = [

11 'create_spec',

12 'list_specs',

13 'update_status',

14 'validate',

15 'estimate',

16 'init_project',

17 'suggest_stack',

18 'generate_tests',

19 'generate_docs',

20 'challenge_spec',

21 'check_readiness',

22 'decompose_spec',

23 'scan_project',

24 'manage_git',

25 'product_insights',

26];

27function strProp(props, key) {

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/product-intelligence/index.js

dist/engine/product-intelligence/index.jsView on unpkg · L7

dist/tools/auto-update-spec.jsView file

Lines 1-21javascript

1// tools/auto-update-spec.ts — auto_update_spec handler (SPEC-170)

2import { execFile } from 'node:child_process';

3import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/tools/auto-update-spec.jsView on unpkg · L1

4import { specStore } from '../storage/index.js';

5import { autoUpdateSpecFromCode } from

dist/engine/verifier/code-scanner.jsView file

Lines 1-25javascript

1// engine/verifier/code-scanner.ts — Spec evidence scanner (SPEC-406)

2import { readFile } from 'node:fs/promises';

3import { exec } from 'node:child_process';

4import { promisify } from 'node:util';

5import { glob } from 'glob';

6const execAsync

dist/engine/auditor-security/electron-checks.jsView file

Lines 54-83javascript

54 category: 'security',

55 severity: 'error',

56 rule: 'electron-sandbox-disabled',

57 message: 'sandbox: false removes the Chromium sandbox from the renderer process.',

58 suggestion: 'Keep sandbox: true (default). Combine with contextBridge for safe IPC.',

dist/tools/import-spec-handler.jsView file

Lines 128-168javascript

128 return compactError('❌ CSV row is empty');

129 }

130 imported = first;

131 break;

132 }

133 default:

134 return compactError(`❌ Unknown source: ${String

dist/engine/delete-first/duplication-finder.jsView file

Lines 1-21javascript

1// Planu — Duplication finder (SPEC-482)

2// Hash-compares normalized code blocks with a sliding window to detect copy-paste.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine/delete-first/duplication-finder.jsView on unpkg · L1

3import { readFileSync } from 'node:fs';

4import { createHash } from 'node:crypto';

5/** Minimum number of lines for a block to be considered a duplication candidate. */

6const

dist/tools/rollback-release.jsView file

Lines 28-68javascript

28 if (dateStr) {

29 resolve(new Date(dateStr));

30 return;

31 }

32 }

33 catch {

34 // ignore

35 }

dist/config/hook-templates/planu-session-safeguard.shView file

•path = dist/config/hook-templates/planu-session-safeguard.sh kind = build_helper sizeBytes = 535 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/config/hook-templates/planu-session-safeguard.shView on unpkg

dist/config/mobile-ci-templates/android-github-actions.ymlView file

Lines 68-108yaml

68 uses: actions/cache@v4

69 with:

70 path: |

71 ~/.gradle/caches

72 ~/.gradle/wrapper

73 key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

74 restore-keys: ${{ runner.os }}-gradle-

dist/engine/ci-generator/android-jobs.jsView file

95patternName = generic_password severity = medium line = 95 matchedText = ` -Pand...\\`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L95

97patternName = generic_password severity = medium line = 97 matchedText = ` -Pand...D"`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L97

dist/engine/telemetry/telemetry-client.jsView file

5patternName = supabase_service_key severity = critical line = 5 matchedText = const SU...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/telemetry/telemetry-client.js

dist/engine/telemetry/telemetry-client.jsView on unpkg · L5

Source & flagged code

14 flagged · loading source

dist/engine/product-intelligence/index.jsView file

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/engine/product-intelligence/index.jsView on unpkg · L7

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/product-intelligence/index.js

dist/engine/product-intelligence/index.jsView on unpkg · L7

dist/tools/auto-update-spec.jsView file

1// tools/auto-update-spec.ts — auto_update_spec handler (SPEC-170) L2: import { execFile } from 'node:child_process'; L3: import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/tools/auto-update-spec.jsView on unpkg · L1

dist/engine/verifier/code-scanner.jsView file

5import { glob } from 'glob'; L6: const execAsync = promisify(exec); L7: const SOURCE_GLOBS = ['**/*.ts', '**/*.js', '**/*.py', '**/*.go', '**/*.java', '**/*.rs'];

High

Shell

Package source references shell execution.

dist/engine/verifier/code-scanner.jsView on unpkg · L5

dist/engine/auditor-security/electron-checks.jsView file

74rule: 'electron-eval-in-renderer', L75: message: 'eval() in Electron renderer enables remote code execution if XSS is present.', L76: suggestion: 'Remove all eval() calls. Use JSON.parse() or safer alternatives.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/engine/auditor-security/electron-checks.jsView on unpkg · L74

dist/tools/import-spec-handler.jsView file

148*/ L149: export async function handleBulkImport(params) { L150: const { source, filePath, content, projectPath, overwrite = false } = params;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/import-spec-handler.jsView on unpkg · L148

dist/engine/delete-first/duplication-finder.jsView file

1// Planu — Duplication finder (SPEC-482) L2: // Hash-compares normalized code blocks with a sliding window to detect copy-paste.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine/delete-first/duplication-finder.jsView on unpkg · L1

dist/tools/rollback-release.jsView file

48return new Promise((resolve) => { L49: const child = spawn('npx', ['--yes', '@planu/cli@latest', '--version'], { L50: stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/tools/rollback-release.jsView on unpkg · L48

dist/config/hook-templates/planu-session-safeguard.shView file

•path = dist/config/hook-templates/planu-session-safeguard.sh kind = build_helper sizeBytes = 535 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/config/hook-templates/planu-session-safeguard.shView on unpkg

dist/config/mobile-ci-templates/android-github-actions.ymlView file

88patternName = generic_password severity = medium line = 88 matchedText = -Pandroi...D" \

Medium

Secret Pattern

Hardcoded password in dist/config/mobile-ci-templates/android-github-actions.yml

dist/config/mobile-ci-templates/android-github-actions.ymlView on unpkg · L88

90patternName = generic_password severity = medium line = 90 matchedText = -Pandroi...ORD"

Medium

Secret Pattern

Hardcoded password in dist/config/mobile-ci-templates/android-github-actions.yml

dist/config/mobile-ci-templates/android-github-actions.ymlView on unpkg · L90

dist/engine/ci-generator/android-jobs.jsView file

95patternName = generic_password severity = medium line = 95 matchedText = ` -Pand...\\`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L95

97patternName = generic_password severity = medium line = 97 matchedText = ` -Pand...D"`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L97

dist/engine/telemetry/telemetry-client.jsView file

5patternName = supabase_service_key severity = critical line = 5 matchedText = const SU...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/telemetry/telemetry-client.js

dist/engine/telemetry/telemetry-client.jsView on unpkg · L5

Findings

3 Critical3 High9 Medium9 Low

CriticalCritical Secretdist/engine/product-intelligence/index.js

CriticalSecret Patterndist/engine/product-intelligence/index.js

CriticalSecret Patterndist/engine/telemetry/telemetry-client.js

HighChild Processdist/tools/auto-update-spec.js

HighShelldist/engine/verifier/code-scanner.js

HighRuntime Package Installdist/tools/rollback-release.js

MediumDynamic Requiredist/tools/import-spec-handler.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/config/hook-templates/planu-session-safeguard.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/config/mobile-ci-templates/android-github-actions.yml

MediumSecret Patterndist/engine/ci-generator/android-jobs.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/engine/auditor-security/electron-checks.js

LowWeak Cryptodist/engine/delete-first/duplication-finder.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

82%Warn

Verdict confidence

IntentDangerous Capability

TypePolicy blocked: AI-agent control surface

False-positive riskMedium

Review stagesource_first_review

Firewall policyAI-agent policy block

Package metadata

npm

Maintainersplanudev

Version4.11.1

PublishedJun 30, 2026

LicenseSEE LICENSE IN LICENSE

Dependencies13

Integrityverified

Package size3.56 MB

Files5,627

Keywordsmcpmcp-servermodel-context-protocolplanusddspec-driven-developmentclaude-codeclaude-desktop

LinksHomepage

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → ./dist/index.d.tsbin → cli, planu

Runtimenode >=24.0.0

Artifact13.4 MB · 5,627 files1 signature(s)

Install lifecycleprepareprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsTelemetryUrlStringsNoLicense

Source & flagged code

14 flagged

dist/engine/product-intelligence/index.jsView file

Lines 1-27javascript

1// engine/product-intelligence/index.ts — SPEC-328: Product Intelligence Layer engine.

2// Queries Supabase telemetry_events to generate product insights reports.

3// Uses the same auth pattern as telemetry-client.ts (fire-and-forget-friendly).

4import { PLANU_VERSION } from '../../config/version.js';

5const SUPABASE_URL = process.env.PLANU_SUPABASE_URL ?? 'https://canusqigtzldstnjddio.supabase.co';

6const SUPABASE_KEY = process.env.PLANU_SUPABASE_KEY ??

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/engine/product-intelligence/index.jsView on unpkg · L7

8const TELEMETRY_TABLE = `${SUPABASE_URL}/rest/v1/telemetry_events`;

9/** Core tools expected to be active — used for dead-tool detection. */

10const KNOWN_CORE_TOOLS = [

11 'create_spec',

12 'list_specs',

13 'update_status',

14 'validate',

15 'estimate',

16 'init_project',

17 'suggest_stack',

18 'generate_tests',

19 'generate_docs',

20 'challenge_spec',

21 'check_readiness',

22 'decompose_spec',

23 'scan_project',

24 'manage_git',

25 'product_insights',

26];

27function strProp(props, key) {

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/product-intelligence/index.js

dist/engine/product-intelligence/index.jsView on unpkg · L7

dist/tools/auto-update-spec.jsView file

Lines 1-21javascript

1// tools/auto-update-spec.ts — auto_update_spec handler (SPEC-170)

2import { execFile } from 'node:child_process';

3import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/tools/auto-update-spec.jsView on unpkg · L1

4import { specStore } from '../storage/index.js';

5import { autoUpdateSpecFromCode } from

dist/engine/verifier/code-scanner.jsView file

Lines 1-25javascript

1// engine/verifier/code-scanner.ts — Spec evidence scanner (SPEC-406)

2import { readFile } from 'node:fs/promises';

3import { exec } from 'node:child_process';

4import { promisify } from 'node:util';

5import { glob } from 'glob';

6const execAsync

dist/engine/auditor-security/electron-checks.jsView file

Lines 54-83javascript

54 category: 'security',

55 severity: 'error',

56 rule: 'electron-sandbox-disabled',

57 message: 'sandbox: false removes the Chromium sandbox from the renderer process.',

58 suggestion: 'Keep sandbox: true (default). Combine with contextBridge for safe IPC.',

dist/tools/import-spec-handler.jsView file

Lines 128-168javascript

128 return compactError('❌ CSV row is empty');

129 }

130 imported = first;

131 break;

132 }

133 default:

134 return compactError(`❌ Unknown source: ${String

dist/engine/delete-first/duplication-finder.jsView file

Lines 1-21javascript

1// Planu — Duplication finder (SPEC-482)

2// Hash-compares normalized code blocks with a sliding window to detect copy-paste.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine/delete-first/duplication-finder.jsView on unpkg · L1

3import { readFileSync } from 'node:fs';

4import { createHash } from 'node:crypto';

5/** Minimum number of lines for a block to be considered a duplication candidate. */

6const

dist/tools/rollback-release.jsView file

Lines 28-68javascript

28 if (dateStr) {

29 resolve(new Date(dateStr));

30 return;

31 }

32 }

33 catch {

34 // ignore

35 }

dist/config/hook-templates/planu-session-safeguard.shView file

•path = dist/config/hook-templates/planu-session-safeguard.sh kind = build_helper sizeBytes = 535 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/config/hook-templates/planu-session-safeguard.shView on unpkg

dist/config/mobile-ci-templates/android-github-actions.ymlView file

Lines 68-108yaml

68 uses: actions/cache@v4

69 with:

70 path: |

71 ~/.gradle/caches

72 ~/.gradle/wrapper

73 key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

74 restore-keys: ${{ runner.os }}-gradle-

dist/engine/ci-generator/android-jobs.jsView file

95patternName = generic_password severity = medium line = 95 matchedText = ` -Pand...\\`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L95

97patternName = generic_password severity = medium line = 97 matchedText = ` -Pand...D"`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L97

dist/engine/telemetry/telemetry-client.jsView file

5patternName = supabase_service_key severity = critical line = 5 matchedText = const SU...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/telemetry/telemetry-client.js

dist/engine/telemetry/telemetry-client.jsView on unpkg · L5