@programinglive/dev-workflow-mcp-server@1.19.23
MCP server to enforce development workflow discipline
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe runtime monitor is opt-in, but when enabled it sends identifying project paths and user-authored task information without a clear consent prompt or documented disclosure in the package metadata. This supports a privacy-risk warning, not a finding of credential theft or malicious default exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Normal workflow state reporting when DEVWF_MONITOR_URL is configured.
Impact
The configured receiver can learn local project paths and user-authored workflow details.
Mechanism
The server POSTs snapshots and event details, including project paths and task text, to the configured endpoint.
AI rationale
The runtime monitor is opt-in, but when enabled it sends identifying project paths and user-authored task information without a clear consent prompt or documented disclosure in the package metadata. This supports a privacy-risk warning, not a finding of credential theft or malicious default exfiltration.
Evidence
monitor.jsworkflow-state.js
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Snapshots include the machine name, full project path, task description, task type and plan.
- Event reports can include up to 1,000 characters of free-form detail.
- Reports are POSTed to the endpoint configured through DEVWF_MONITOR_URL; no receiver is hard-coded.
- Workflow state handling invokes snapshot reporting during normal operation.
Evidence against
- Monitoring is disabled when DEVWF_MONITOR_URL is unset.
- The postinstall script creates a workflow state file under the installer's project directory and does not send data.
- The setup command that changes OpenCode configuration is separate from the install lifecycle scripts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgexec.jsView file
1import { exec as execCallback, execFile as execFileCallback } from "child_process";
L2: import { existsSync } from "fs";
High
Findings
6 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processexec.js
HighShellscripts/install-husky.js
HighSandbox Evasion Gated Capabilityscripts/setup-stack.js
HighRuntime Package Installscripts/setup-stack.js
HighSemantic Analysis Limitedexec.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiresecurity/log-bridge.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/setup-test-dbs.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @programinglive/dev-workflow-mcp-server@1.19.23.
See all versions of @programinglive/dev-workflow-mcp-server for other recorded verdicts.
- Review the evidence and your use of @programinglive/dev-workflow-mcp-server@1.19.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.