registry / @polarity-lab/cosmos-mcp / 0.9.24

@polarity-lab/cosmos-mcp@0.9.24

MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is an MCP server plus explicit user-invoked local data sync tooling for a Cosmos service.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Install runs native addon rebuild; runtime actions require user CLI/MCP commands such as init, provision, menu install, daemon install, or source sync.

Impact

User-authorized local personal data upload and macOS helper installation; no covert install/import-time attack found.

Mechanism

MCP server and explicit local-data sync CLI

Rationale

The flagged primitives are real but aligned with documented MCP authentication, local sync, native rebuild, update, and macOS helper features that are activated by user commands. Static source inspection did not identify concrete malicious behavior warranting a block.

Evidence

package.jsonREADME.mdbin/cosmos-mcp.jsdist/server.jsdist/client/cosmos.jsdist/config.jsdist/auth/bootstrap.jsdist/daemon/menu-cli.jsdist/daemon/manage.jsdist/sources/browser/readers.jsdist/sources/shell-history/sync.jsdist/sources/claude-desktop/sync.js~/.config/cosmos-mcp/token~/Library/Application Support/cosmos-mcp/cosmos-mcp-handler.app~/Library/LaunchAgents/com.polaritylab.cosmos-mcp.menu.plist~/Library/LaunchAgents/com.polaritylab.cosmos-mcp.sync.plist~/.cosmos/sync-config.json~/.zsh_history~/.bash_history~/.config/fish/fish_history~/Library/Messages/chat.db~/Library/Safari/History.db~/Library/Application Support/Google/Chrome/Default/History~/.claude/projects

Network endpoints6

cosmos.polarity-lab.comcosmos.polarity-lab.com/api/mcpcosmos.polarity-lab.com/api/capturecosmos.polarity-lab.com/api/chatregistry.npmjs.org/@polarity-lab/cosmos-mcp/latest127.0.0.1:11434

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json defines postinstall, but it only runs `npm rebuild better-sqlite3`.
bin/cosmos-mcp.js and dist/daemon/*.js use child_process, launchctl, cp/rm, and npx for explicit macOS provisioning/menu/daemon/update commands.
dist/sources/* sync commands read sensitive local data including iMessage, browser history, calendar, shell history, and Claude transcripts.

Evidence against

dist/server.js import-time behavior is an MCP stdio server that loads config and dispatches declared tools.
dist/client/cosmos.js sends requests only to configured Cosmos URL, defaulting to https://cosmos.polarity-lab.com, with documented auth headers.
dist/config.js reads specific COSMOS_* env vars and ~/.config/cosmos-mcp/token; no broad env harvesting found.
dist/auth/bootstrap.js uses a loopback OAuth flow and writes the token file with 0600 permissions.
README.md documents provisioning, local data sources, keychain/token storage, and macOS handler/menu behavior.
No covert install-time exfiltration, obfuscated staged loader, destructive payload, reviewer prompt injection, or unconsented AI-agent config mutation found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 256 KB of source, external domains: 127.0.0.1, cosmos.polarity-lab.com, registry.npmjs.org, www.apple.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 4-44json

4 "mcpName": "io.github.teampolarity/cosmos-mcp",

5 "description": "MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.",

6 "license": "MIT",

7 "type": "module",

8 "main": "dist/server.js",

9 "bin": {

10 "cosmos-mcp": "bin/cosmos-mcp.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/server.js",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "npm rebuild better-sqlite3 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "lint": "tsc --noEmit"

27 },

28 "dependencies": {

29 "@modelcontextprotocol/sdk": "^1.0.4",

30 "better-sqlite3": "^12.10.0",

31 "node-typedstream": "^1.4.1",

32 "zod": "^3.23.8"

33 },

34 "devDependencies": {

35 "@types/better-sqlite3": "^7.6.13",

36 "@types/node": "^22.10.0",

37 "typescript": "^5.7.2",

38 "vitest": "~2.1.9"

39 },

40 "engines": {

41 "node": ">=20"

42 },

43 "repository": {

44 "type": "git",

bin/cosmos-mcp.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// cosmos-mcp CLI entrypoint.

3//

4// Routes top-level subcommands to compiled `dist/` modules. The provision /

5// install-handler / imessage probe paths live inline here, both because they

6// are tiny and because they must not depend on the rest of the build being

7// present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh

8// install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet).

10import { execFile, execFileSync, spawnSync } from "node:child_process";

dist/daemon/manage.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";

3import { platform } from "node:os";

4import { intervalSeconds, loadSyncConfig, saveSyncConfig, } from "./config.js";

5import { DAEMON_LABEL, daemonPaths, packagedAppPath, resolveNpxPath } from "./paths.js"

dist/auth/bootstrap.jsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { writeFileSync, mkdirSync, chmodSync } from "node:fs";

3import { randomBytes } from "node:crypto";

4import { execFile } from "node:child_process";

5import { TOKEN_PATHS } from "../config.js";

dist/Cosmos.zipView file

•path = dist/Cosmos.zip kind = compressed_blob sizeBytes = 296469 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/Cosmos.zipView on unpkg

•path = dist/Cosmos.zip kind = nested_archive_needs_inspection sizeBytes = 296469 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/Cosmos.zipView on unpkg

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView file

•path = dist/Cosmos.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 118589 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView on unpkg

dist/daemon/menu-cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @polarity-lab/cosmos-mcp@0.9.18 matchedIdentity = npm:[redacted]:0.9.18 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/daemon/menu-cli.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = npm rebuild better-sqlite3 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm rebuild better-sqlite3 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cosmos-mcp.jsView file

9L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/cosmos-mcp.jsView on unpkg · L9

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L9: L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module"; ... L19: const __filename = fileURLToPath(import.meta.url); L20: const __dirname = dirname(__filename); L21: const PACKAGE_ROOT = join(__dirname, ".."); ... L26: const KEYCHAIN_SERVICE = "cosmos-mcp-key"; L27: const DEFAULT_COSMOS_URL = process.env.COSMOS_BASE_URL || process.env.COSMOS_URL || "https://cosmos.polarity-lab.com"; L28: ... L140: if (!node) { L141: process.stderr.write( L142: "better-sqlite3 was built for a different Node.js than the one running.\n\n" +

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cosmos-mcp.jsView on unpkg · L9

6// are tiny and because they must not depend on the rest of the build being L7: // present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh L8: // install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet). L9: L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cosmos-mcp.jsView on unpkg · L6

dist/daemon/manage.jsView file

1import { execFileSync, spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs"; ... L8: const blocks = [ L9: "#!/bin/bash", L10: `# cosmos-mcp daemon runner. Invoked by launchd every ${mins} minutes.`, ... L74: if (existsSync(paths.plistPath)) { L75: const r = spawnSync("/bin/launchctl", ["list", DAEMON_LABEL], { encoding: "utf8" }); L76: loaded = r.status === 0; ... L138: if (loadRes.status !== 0) { L139: return { ok: false, error: `launchctl load failed: ${(loadRes.stderr || "").trim()}` }; L140: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/daemon/manage.jsView on unpkg · L1

dist/auth/bootstrap.jsView file

1import { createServer } from "node:http"; L2: import { writeFileSync, mkdirSync, chmodSync } from "node:fs"; L3: import { randomBytes } from "node:crypto"; L4: import { execFile } from "node:child_process"; L5: import { TOKEN_PATHS } from "../config.js"; L6: const DEFAULT_COSMOS_URL = process.env.COSMOS_URL || "https://cosmos.polarity-lab.com"; L7: export async function runBootstrap() {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/auth/bootstrap.jsView on unpkg · L1

dist/Cosmos.zipView file

•path = dist/Cosmos.zip kind = compressed_blob sizeBytes = 296469 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/Cosmos.zipView on unpkg

•path = dist/Cosmos.zip kind = nested_archive_needs_inspection sizeBytes = 296469 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/Cosmos.zipView on unpkg

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView file

•path = dist/Cosmos.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 118589 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView on unpkg

dist/daemon/menu-cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/daemon/menu-cli.jsView on unpkg

Findings

1 Critical7 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/daemon/menu-cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cosmos-mcp.js

HighShell

HighEntrypoint Build Divergencebin/cosmos-mcp.js

HighSame File Env Network Executiondist/auth/bootstrap.js

HighRuntime Package Installbin/cosmos-mcp.js

HighShips High Entropy Blobdist/Cosmos.app/Contents/Resources/AppIcon.icns

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/daemon/manage.js

MediumShips Compressed Blobdist/Cosmos.zip

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/Cosmos.zip

Source & flagged code

11 flagged

package.jsonView file

Lines 4-44json

4 "mcpName": "io.github.teampolarity/cosmos-mcp",

5 "description": "MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.",

6 "license": "MIT",

7 "type": "module",

8 "main": "dist/server.js",

9 "bin": {

10 "cosmos-mcp": "bin/cosmos-mcp.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/server.js",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "npm rebuild better-sqlite3 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "lint": "tsc --noEmit"

27 },

28 "dependencies": {

29 "@modelcontextprotocol/sdk": "^1.0.4",

30 "better-sqlite3": "^12.10.0",

31 "node-typedstream": "^1.4.1",

32 "zod": "^3.23.8"

33 },

34 "devDependencies": {

35 "@types/better-sqlite3": "^7.6.13",

36 "@types/node": "^22.10.0",

37 "typescript": "^5.7.2",

38 "vitest": "~2.1.9"

39 },

40 "engines": {

41 "node": ">=20"

42 },

43 "repository": {

44 "type": "git",

bin/cosmos-mcp.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// cosmos-mcp CLI entrypoint.

3//

4// Routes top-level subcommands to compiled `dist/` modules. The provision /

5// install-handler / imessage probe paths live inline here, both because they

6// are tiny and because they must not depend on the rest of the build being

7// present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh

8// install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet).

10import { execFile, execFileSync, spawnSync } from "node:child_process";

dist/daemon/manage.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";

3import { platform } from "node:os";

4import { intervalSeconds, loadSyncConfig, saveSyncConfig, } from "./config.js";

5import { DAEMON_LABEL, daemonPaths, packagedAppPath, resolveNpxPath } from "./paths.js"

dist/auth/bootstrap.jsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { writeFileSync, mkdirSync, chmodSync } from "node:fs";

3import { randomBytes } from "node:crypto";

4import { execFile } from "node:child_process";

5import { TOKEN_PATHS } from "../config.js";

dist/Cosmos.zipView file

•path = dist/Cosmos.zip kind = compressed_blob sizeBytes = 296469 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/Cosmos.zipView on unpkg

•path = dist/Cosmos.zip kind = nested_archive_needs_inspection sizeBytes = 296469 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/Cosmos.zipView on unpkg

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView file

•path = dist/Cosmos.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 118589 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView on unpkg

dist/daemon/menu-cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/daemon/menu-cli.jsView on unpkg