registry / @polarity-lab/cosmos-mcp / 0.9.12

@polarity-lab/cosmos-mcp@0.9.12

MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No install-time malware was confirmed. The main risk is a memory MCP server whose tool metadata encourages agents to persist conversation text to Cosmos automatically, plus user-invoked local data sync commands.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the MCP server and an agent calling cosmos_capture_turn, or user invoking sync/daemon commands

Impact

Conversation content, iMessage/browser/Claude/shell/calendar-derived data may be uploaded to the configured Cosmos service when tools or sync commands run.

Mechanism

MCP memory capture and optional local data sync to Cosmos APIs

Attack narrative

If an MCP client trusts tool descriptions, cosmos_capture_turn's description can steer the agent to upload substantive user/assistant exchanges to Cosmos without a fresh user request. This is aligned with a memory product but remains a sensitive AI-agent control-surface behavior. Other local data uploads appear gated by explicit sync or daemon setup commands.

Rationale

Source inspection did not find install-time exfiltration, destructive behavior, or hidden lifecycle execution beyond a native rebuild. Because the package intentionally syncs sensitive local and conversation data and includes an agent-directive auto-capture prompt, it is best treated as a warning-level dangerous capability rather than confirmed malware.

Evidence

package.jsonbin/cosmos-mcp.jsdist/server.jsdist/client/cosmos.jsdist/tools/index.jsdist/sources/imessage/sync.jsdist/sources/browser/cli.jsdist/sources/claude-desktop/sync.jsdist/sources/shell-history/sync.jsdist/daemon/manage.jsdist/CosmosSync.zip~/.config/cosmos-mcp/token~/Library/Application Support/cosmos-mcp/cosmos-mcp-handler.app~/Library/LaunchAgents/com.polaritylab.cosmos-mcp.sync.plist~/Library/Application Support/cosmos-mcp/daemon-run.sh~/.cosmos/*.json

Network endpoints5

cosmos.polarity-lab.comcosmos.polarity-lab.com/api/polarity/capture-turncosmos.polarity-lab.com/api/me/connectors/conversations/turnscosmos.polarity-lab.com/api/me/connectors/browser/visitsregistry.npmjs.org/@polarity-lab/cosmos-mcp/latest

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/tools/index.js tool description tells agents to call cosmos_capture_turn at end of every substantive exchange without being asked
dist/client/cosmos.js sends tool payloads to Cosmos API with X-MCP-Key/X-System-Key auth headers
dist/sources/imessage/sync.js, browser/cli.js, claude-desktop/sync.js, and shell-history/sync.js upload local messages/history/sessions/commands when invoked
dist/CosmosSync.zip and dist/CosmosSync.app ship macOS binaries, limiting full source auditability

Evidence against

package.json postinstall only runs npm rebuild better-sqlite3 and ignores failure
bin/cosmos-mcp.js child_process use is for macOS keychain, LaunchServices handler, native rebuild/reexec, and subcommand dispatch
Network endpoints are consistent with the package's Cosmos memory/sync purpose
Persistence via launchd daemon is behind explicit daemon/menu install commands, not package install/import
No install-time credential harvesting or automatic import-time exfiltration found

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 248 KB of source, external domains: 127.0.0.1, cosmos.polarity-lab.com, registry.npmjs.org, www.apple.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 4-44json

4 "mcpName": "io.github.teampolarity/cosmos-mcp",

5 "description": "MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.",

6 "license": "MIT",

7 "type": "module",

8 "main": "dist/server.js",

9 "bin": {

10 "cosmos-mcp": "bin/cosmos-mcp.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/server.js",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "npm rebuild better-sqlite3 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "lint": "tsc --noEmit"

27 },

28 "dependencies": {

29 "@modelcontextprotocol/sdk": "^1.0.4",

30 "better-sqlite3": "^12.10.0",

31 "node-typedstream": "^1.4.1",

32 "zod": "^3.23.8"

33 },

34 "devDependencies": {

35 "@types/better-sqlite3": "^7.6.13",

36 "@types/node": "^22.10.0",

37 "typescript": "^5.7.2",

38 "vitest": "~2.1.9"

39 },

40 "engines": {

41 "node": ">=20"

42 },

43 "repository": {

44 "type": "git",

bin/cosmos-mcp.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// cosmos-mcp CLI entrypoint.

3//

4// Routes top-level subcommands to compiled `dist/` modules. The provision /

5// install-handler / imessage probe paths live inline here, both because they

6// are tiny and because they must not depend on the rest of the build being

7// present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh

8// install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet).

10import { execFile, execFileSync, spawnSync } from "node:child_process";

dist/daemon/manage.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";

3import { platform } from "node:os";

4import { intervalSeconds, loadSyncConfig, saveSyncConfig, } from "./config.js";

5import { DAEMON_LABEL, daemonPaths, packagedAppPath, resolveNpxPath } from "./paths.js"

dist/auth/bootstrap.jsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { writeFileSync, mkdirSync, chmodSync } from "node:fs";

3import { randomBytes } from "node:crypto";

4import { execFile } from "node:child_process";

5import { TOKEN_PATHS } from "../config.js";

dist/CosmosSync.zipView file

•path = dist/CosmosSync.zip kind = high_entropy_blob sizeBytes = 50245 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/CosmosSync.zipView on unpkg

•path = dist/CosmosSync.zip kind = compressed_blob sizeBytes = 50245 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/CosmosSync.zipView on unpkg

•path = dist/CosmosSync.zip kind = nested_archive_needs_inspection sizeBytes = 50245 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/CosmosSync.zipView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = npm rebuild better-sqlite3 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm rebuild better-sqlite3 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cosmos-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @polarity-lab/cosmos-mcp@0.9.10 matchedIdentity = npm:[redacted]:0.9.10 similarity = 0.911 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/cosmos-mcp.jsView on unpkg

9L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/cosmos-mcp.jsView on unpkg · L9

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L9: L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module"; ... L19: const __filename = fileURLToPath(import.meta.url); L20: const __dirname = dirname(__filename); L21: const PACKAGE_ROOT = join(__dirname, ".."); ... L26: const KEYCHAIN_SERVICE = "cosmos-mcp-key"; L27: const DEFAULT_COSMOS_URL = process.env.COSMOS_BASE_URL || process.env.COSMOS_URL || "https://cosmos.polarity-lab.com"; L28: ... L140: if (!node) { L141: process.stderr.write( L142: "better-sqlite3 was built for a different Node.js than the one running.\n\n" +

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cosmos-mcp.jsView on unpkg · L9

6// are tiny and because they must not depend on the rest of the build being L7: // present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh L8: // install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet). L9: L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cosmos-mcp.jsView on unpkg · L6

dist/daemon/manage.jsView file

1import { execFileSync, spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs"; ... L8: const blocks = [ L9: "#!/bin/bash", L10: `# cosmos-mcp daemon runner. Invoked by launchd every ${mins} minutes.`, ... L74: if (existsSync(paths.plistPath)) { L75: const r = spawnSync("/bin/launchctl", ["list", DAEMON_LABEL], { encoding: "utf8" }); L76: loaded = r.status === 0; ... L138: if (loadRes.status !== 0) { L139: return { ok: false, error: `launchctl load failed: ${(loadRes.stderr || "").trim()}` }; L140: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/daemon/manage.jsView on unpkg · L1

dist/auth/bootstrap.jsView file

1import { createServer } from "node:http"; L2: import { writeFileSync, mkdirSync, chmodSync } from "node:fs"; L3: import { randomBytes } from "node:crypto"; L4: import { execFile } from "node:child_process"; L5: import { TOKEN_PATHS } from "../config.js"; L6: const DEFAULT_COSMOS_URL = process.env.COSMOS_URL || "https://cosmos.polarity-lab.com"; L7: export async function runBootstrap() {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/auth/bootstrap.jsView on unpkg · L1

dist/CosmosSync.zipView file

•path = dist/CosmosSync.zip kind = high_entropy_blob sizeBytes = 50245 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/CosmosSync.zipView on unpkg

•path = dist/CosmosSync.zip kind = compressed_blob sizeBytes = 50245 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/CosmosSync.zipView on unpkg

•path = dist/CosmosSync.zip kind = nested_archive_needs_inspection sizeBytes = 50245 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/CosmosSync.zipView on unpkg

Findings

1 Critical7 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/cosmos-mcp.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cosmos-mcp.js

HighShell

HighEntrypoint Build Divergencebin/cosmos-mcp.js

HighSame File Env Network Executiondist/auth/bootstrap.js

HighRuntime Package Installbin/cosmos-mcp.js

HighShips High Entropy Blobdist/CosmosSync.zip

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/daemon/manage.js

MediumShips Compressed Blobdist/CosmosSync.zip

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/CosmosSync.zip

Source & flagged code

11 flagged

package.jsonView file

Lines 4-44json

4 "mcpName": "io.github.teampolarity/cosmos-mcp",

5 "description": "MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.",

6 "license": "MIT",

7 "type": "module",

8 "main": "dist/server.js",

9 "bin": {

10 "cosmos-mcp": "bin/cosmos-mcp.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/server.js",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "npm rebuild better-sqlite3 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "lint": "tsc --noEmit"

27 },

28 "dependencies": {

29 "@modelcontextprotocol/sdk": "^1.0.4",

30 "better-sqlite3": "^12.10.0",

31 "node-typedstream": "^1.4.1",

32 "zod": "^3.23.8"

33 },

34 "devDependencies": {

35 "@types/better-sqlite3": "^7.6.13",

36 "@types/node": "^22.10.0",

37 "typescript": "^5.7.2",

38 "vitest": "~2.1.9"

39 },

40 "engines": {

41 "node": ">=20"

42 },

43 "repository": {

44 "type": "git",

bin/cosmos-mcp.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// cosmos-mcp CLI entrypoint.

3//

4// Routes top-level subcommands to compiled `dist/` modules. The provision /

5// install-handler / imessage probe paths live inline here, both because they

6// are tiny and because they must not depend on the rest of the build being

7// present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh

8// install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet).

10import { execFile, execFileSync, spawnSync } from "node:child_process";

dist/daemon/manage.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";

3import { platform } from "node:os";

4import { intervalSeconds, loadSyncConfig, saveSyncConfig, } from "./config.js";

5import { DAEMON_LABEL, daemonPaths, packagedAppPath, resolveNpxPath } from "./paths.js"

dist/auth/bootstrap.jsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { writeFileSync, mkdirSync, chmodSync } from "node:fs";

3import { randomBytes } from "node:crypto";

4import { execFile } from "node:child_process";

5import { TOKEN_PATHS } from "../config.js";

dist/CosmosSync.zipView file

•path = dist/CosmosSync.zip kind = high_entropy_blob sizeBytes = 50245 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/CosmosSync.zipView on unpkg

•path = dist/CosmosSync.zip kind = compressed_blob sizeBytes = 50245 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/CosmosSync.zipView on unpkg

•path = dist/CosmosSync.zip kind = nested_archive_needs_inspection sizeBytes = 50245 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/CosmosSync.zipView on unpkg