@programinglive/dev-workflow-mcp-server@1.23.0
MCP server to enforce development workflow discipline
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe setup command is clearly documented and user-invoked, but it changes global OpenCode configuration and installs additional integrations beyond this MCP server. That broader agent configuration capability warrants a warning; the lifecycle hooks and monitor behavior reviewed do not show an automatic attack.
Decision evidence
public snapshot- The setup command registers the Superpowers plugin and this MCP server globally in OpenCode.
- The setup command can also register RTK globally for OpenCode.
- The README documents this stack setup and directs users to invoke it explicitly.
- The setup script runs only when directly invoked; it is not an install lifecycle script.
- The runtime monitor sends data only when DEVWF_MONITOR_URL is configured.
- The postinstall hook creates a local workflow state file; no network contact was identified in it.
Source & flagged code
10 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @programinglive/dev-workflow-mcp-server@1.23.0.
See all versions of @programinglive/dev-workflow-mcp-server for other recorded verdicts.
- Review the evidence and your use of @programinglive/dev-workflow-mcp-server@1.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.