registry / @programinglive/dev-workflow-mcp-server / 1.19.19
@programinglive/dev-workflow-mcp-server@1.19.19
MCP server to enforce development workflow discipline
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe lifecycle behavior initializes the workflow state file this package is designed to manage, and the prepare hook skips outside a Git checkout. Optional monitoring requires a configured destination; agent setup and token rotation are explicit operations, so the scanner findings do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Postinstall initializes local workflow state; monitoring requires a configured DEVWF_MONITOR_URL; broader agent setup and token rotation require explicit commands.
Impact
No automatic credential collection, unrelated network contact, or agent configuration change was identified.
Mechanism
The inspected code writes a local state file and sends workflow snapshots only to a user-configured monitor. Setup and token rotation are separate user-invoked operations.
AI rationale
The lifecycle behavior initializes the workflow state file this package is designed to manage, and the prepare hook skips outside a Git checkout. Optional monitoring requires a configured destination; agent setup and token rotation are explicit operations, so the scanner findings do not establish malicious behavior.
Evidence
.state/workflow-state.json (created by postinstall if absent)
Network endpoints1
100.107.65.21:3100/api/session (only in the explicitly applied token-rotation script)
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall creates only the package’s workflow state file under the invoking project’s `.state` directory, and leaves an existing file intact.
- The prepare script skips Husky setup when the package is not in a Git checkout.
- Monitoring sends no data unless `DEVWF_MONITOR_URL` is configured; its source describes the payload as workflow metadata and says file contents are not sent.
- Global OpenCode configuration and agent setup run through the separate setup command, which is guarded to run only when invoked directly.
Evidence against
- The package declares prepare and postinstall lifecycle scripts; postinstall writes a state file in the invoking project.
- The explicit setup command can install a plugin and modify global OpenCode configuration and project AGENTS.md.
- An added token-rotation shell script contacts a hard-coded private monitor address when run with an apply mode.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgexec.jsView file
1import { exec as execCallback, execFile as execFileCallback } from "child_process";
L2: import { existsSync } from "fs";
High
Findings
6 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processexec.js
HighShellscripts/install-husky.js
HighSandbox Evasion Gated Capabilityscripts/setup-stack.js
HighRuntime Package Installscripts/setup-stack.js
HighSemantic Analysis Limitedexec.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiresecurity/log-bridge.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/setup-test-dbs.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @programinglive/dev-workflow-mcp-server@1.19.19.
See all versions of @programinglive/dev-workflow-mcp-server for other recorded verdicts.
- Review the evidence and your use of @programinglive/dev-workflow-mcp-server@1.19.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.