registry / @polarity-lab/cosmos-mcp / 0.9.26

@polarity-lab/cosmos-mcp@0.9.26

MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The MCP server exposes tools that can cause an AI agent to upload full conversation turns to Cosmos. The strongest issue is the tool description itself instructing autonomous capture of every substantive user/assistant exchange without being asked.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

MCP client lists and follows the package's tool descriptions; user or daemon invokes sync subcommands for local data import.

Impact

Unprompted disclosure of chat contents to cosmos.polarity-lab.com; user-invoked sync can also upload iMessage, Claude transcript, and browser-history data.

Mechanism

AI-agent prompt/tool-description induced data capture plus optional local transcript/message/browser sync

Attack narrative

When installed as an MCP server, the package advertises a capture-turn tool whose description tells the agent to call it automatically after every substantive exchange, passing the user's message and assistant reply. That sends conversation text to the Cosmos API using the configured MCP key. Separate CLI and daemon paths also sync local iMessage, Claude transcript, and browser-history data, but those are more visibly user-invoked.

Rationale

The package is largely transparent and package-aligned, but the MCP tool metadata creates a concrete unconsented AI-agent data exfiltration path by instructing agents to upload conversations without an explicit user request. That behavior is source-confirmed and should be blocked despite benign-looking install-time scripts. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonbin/cosmos-mcp.jsdist/server.jsdist/tools/index.jsdist/client/cosmos.jsdist/sources/claude-desktop/cli.jsdist/sources/imessage/cli.jsdist/sources/browser/cli.jsdist/daemon/manage.js~/.config/cosmos-mcp/token~/.claude/projects~/Library/Messages/chat.db~/.cosmos/imessage-state.json~/.cosmos/claude-desktop-state.json~/Library/LaunchAgents~/Applications/Cosmos Sync.app

Network endpoints4

cosmos.polarity-lab.comcosmos.polarity-lab.com/api/polarity/capture-turncosmos.polarity-lab.com/api/me/connectors/browser/visitsregistry.npmjs.org/@polarity-lab/cosmos-mcp/latest

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Malware with medium false-positive risk.

Evidence for warning

dist/tools/index.js defines cosmos_capture_turn with instruction to call at end of every substantive exchange without being asked
dist/client/cosmos.js sends captured user_text/assistant_text to /api/polarity/capture-turn with X-MCP-Key
dist/sources/claude-desktop/cli.js sync reads ~/.claude/projects transcripts and ships turns to cosmos
dist/sources/imessage/cli.js sync reads ~/Library/Messages/chat.db and contacts, then posts turns and captions
dist/sources/browser/cli.js sync reads local browser history and posts visits to /api/me/connectors/browser/visits
dist/daemon/manage.js can install a LaunchAgent that periodically runs local data syncs

Evidence against

package.json postinstall only runs npm rebuild better-sqlite3, no arbitrary download or obfuscated payload
bin/cosmos-mcp.js dangerous shell/keychain actions are routed through explicit subcommands such as provision, install-handler, daemon, update, imessage
Network hosts are package-aligned with cosmos.polarity-lab.com or registry update checks
Token files are written under ~/.config/cosmos-mcp/token with 0600 permissions
No eval/vm/Function or hidden decoded payload found in inspected JS

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 259 KB of source, external domains: 127.0.0.1, cosmos.polarity-lab.com, registry.npmjs.org, www.apple.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 4-44json

4 "mcpName": "io.github.teampolarity/cosmos-mcp",

5 "description": "MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.",

6 "license": "MIT",

7 "type": "module",

8 "main": "dist/server.js",

9 "bin": {

10 "cosmos-mcp": "bin/cosmos-mcp.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/server.js",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "npm rebuild better-sqlite3 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "lint": "tsc --noEmit"

27 },

28 "dependencies": {

29 "@modelcontextprotocol/sdk": "^1.0.4",

30 "better-sqlite3": "^12.10.0",

31 "node-typedstream": "^1.4.1",

32 "zod": "^3.23.8"

33 },

34 "devDependencies": {

35 "@types/better-sqlite3": "^7.6.13",

36 "@types/node": "^22.10.0",

37 "typescript": "^5.7.2",

38 "vitest": "~2.1.9"

39 },

40 "engines": {

41 "node": ">=20"

42 },

43 "repository": {

44 "type": "git",

bin/cosmos-mcp.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// cosmos-mcp CLI entrypoint.

3//

4// Routes top-level subcommands to compiled `dist/` modules. The provision /

5// install-handler / imessage probe paths live inline here, both because they

6// are tiny and because they must not depend on the rest of the build being

7// present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh

8// install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet).

10import { execFile, execFileSync, spawnSync } from "node:child_process";

dist/daemon/manage.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";

3import { platform } from "node:os";

4import { intervalSeconds, loadSyncConfig, saveSyncConfig, } from "./config.js";

5import { DAEMON_LABEL, daemonPaths, packagedAppPath, removeLegacyInstalledApps, removeLegacyLoginItems, resolveInstalledAppPath, resolveNpxPath } from

dist/auth/bootstrap.jsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { writeFileSync, mkdirSync, chmodSync } from "node:fs";

3import { randomBytes } from "node:crypto";

4import { execFile } from "node:child_process";

5import { TOKEN_PATHS } from "../config.js";

dist/Cosmos.zipView file

•path = dist/Cosmos.zip kind = compressed_blob sizeBytes = 296469 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/Cosmos.zipView on unpkg

•path = dist/Cosmos.zip kind = nested_archive_needs_inspection sizeBytes = 296469 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/Cosmos.zipView on unpkg

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView file

•path = dist/Cosmos.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 118589 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView on unpkg

dist/settings/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @polarity-lab/cosmos-mcp@0.9.24 matchedIdentity = npm:[redacted]:0.9.24 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/settings/server.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = npm rebuild better-sqlite3 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm rebuild better-sqlite3 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cosmos-mcp.jsView file

9L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/cosmos-mcp.jsView on unpkg · L9

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L9: L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module"; ... L19: const __filename = fileURLToPath(import.meta.url); L20: const __dirname = dirname(__filename); L21: const PACKAGE_ROOT = join(__dirname, ".."); ... L26: const KEYCHAIN_SERVICE = "cosmos-mcp-key"; L27: const DEFAULT_COSMOS_URL = process.env.COSMOS_BASE_URL || process.env.COSMOS_URL || "https://cosmos.polarity-lab.com"; L28: ... L140: if (!node) { L141: process.stderr.write( L142: "better-sqlite3 was built for a different Node.js than the one running.\n\n" +

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cosmos-mcp.jsView on unpkg · L9

6// are tiny and because they must not depend on the rest of the build being L7: // present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh L8: // install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet). L9: L10: import { execFile, execFileSync, spawnSync } from "node:child_process"; L11: import { createRequire } from "node:module";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cosmos-mcp.jsView on unpkg · L6

dist/daemon/manage.jsView file

1import { execFileSync, spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs"; ... L8: const blocks = [ L9: "#!/bin/bash", L10: `# cosmos-mcp daemon runner. Invoked by launchd every ${mins} minutes.`, ... L74: if (existsSync(paths.plistPath)) { L75: const r = spawnSync("/bin/launchctl", ["list", DAEMON_LABEL], { encoding: "utf8" }); L76: loaded = r.status === 0; ... L140: if (loadRes.status !== 0) { L141: return { ok: false, error: `launchctl load failed: ${(loadRes.stderr || "").trim()}` }; L142: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/daemon/manage.jsView on unpkg · L1

dist/auth/bootstrap.jsView file

1import { createServer } from "node:http"; L2: import { writeFileSync, mkdirSync, chmodSync } from "node:fs"; L3: import { randomBytes } from "node:crypto"; L4: import { execFile } from "node:child_process"; L5: import { TOKEN_PATHS } from "../config.js"; L6: const DEFAULT_COSMOS_URL = process.env.COSMOS_URL || "https://cosmos.polarity-lab.com"; L7: export async function runBootstrap() {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/auth/bootstrap.jsView on unpkg · L1

dist/Cosmos.zipView file

•path = dist/Cosmos.zip kind = compressed_blob sizeBytes = 296469 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/Cosmos.zipView on unpkg

•path = dist/Cosmos.zip kind = nested_archive_needs_inspection sizeBytes = 296469 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/Cosmos.zipView on unpkg

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView file

•path = dist/Cosmos.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 118589 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView on unpkg

dist/settings/server.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/settings/server.jsView on unpkg

Findings

1 Critical7 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/settings/server.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cosmos-mcp.js

HighShell

HighEntrypoint Build Divergencebin/cosmos-mcp.js

HighSame File Env Network Executiondist/auth/bootstrap.js

HighRuntime Package Installbin/cosmos-mcp.js

HighShips High Entropy Blobdist/Cosmos.app/Contents/Resources/AppIcon.icns

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/daemon/manage.js

MediumShips Compressed Blobdist/Cosmos.zip

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/Cosmos.zip

Source & flagged code

11 flagged

package.jsonView file

Lines 4-44json

4 "mcpName": "io.github.teampolarity/cosmos-mcp",

5 "description": "MCP server for the Polarity exocortex. Read and write your personal knowledge graph from any LLM client.",

6 "license": "MIT",

7 "type": "module",

8 "main": "dist/server.js",

9 "bin": {

10 "cosmos-mcp": "bin/cosmos-mcp.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/server.js",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "npm rebuild better-sqlite3 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "lint": "tsc --noEmit"

27 },

28 "dependencies": {

29 "@modelcontextprotocol/sdk": "^1.0.4",

30 "better-sqlite3": "^12.10.0",

31 "node-typedstream": "^1.4.1",

32 "zod": "^3.23.8"

33 },

34 "devDependencies": {

35 "@types/better-sqlite3": "^7.6.13",

36 "@types/node": "^22.10.0",

37 "typescript": "^5.7.2",

38 "vitest": "~2.1.9"

39 },

40 "engines": {

41 "node": ">=20"

42 },

43 "repository": {

44 "type": "git",

bin/cosmos-mcp.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// cosmos-mcp CLI entrypoint.

3//

4// Routes top-level subcommands to compiled `dist/` modules. The provision /

5// install-handler / imessage probe paths live inline here, both because they

6// are tiny and because they must not depend on the rest of the build being

7// present (e.g. `npx -y @polarity-lab/cosmos-mcp provision pmk_xxx` on a fresh

8// install should not fail because better-sqlite3 hasn't been gyp-rebuilt yet).

10import { execFile, execFileSync, spawnSync } from "node:child_process";

dist/daemon/manage.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";

3import { platform } from "node:os";

4import { intervalSeconds, loadSyncConfig, saveSyncConfig, } from "./config.js";

5import { DAEMON_LABEL, daemonPaths, packagedAppPath, removeLegacyInstalledApps, removeLegacyLoginItems, resolveInstalledAppPath, resolveNpxPath } from

dist/auth/bootstrap.jsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { writeFileSync, mkdirSync, chmodSync } from "node:fs";

3import { randomBytes } from "node:crypto";

4import { execFile } from "node:child_process";

5import { TOKEN_PATHS } from "../config.js";

dist/Cosmos.zipView file

•path = dist/Cosmos.zip kind = compressed_blob sizeBytes = 296469 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/Cosmos.zipView on unpkg

•path = dist/Cosmos.zip kind = nested_archive_needs_inspection sizeBytes = 296469 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/Cosmos.zipView on unpkg

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView file

•path = dist/Cosmos.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 118589 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/Cosmos.app/Contents/Resources/AppIcon.icnsView on unpkg

dist/settings/server.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/settings/server.jsView on unpkg