registry / @prom.codes/saver / 0.2.0

@prom.codes/saver@0.2.0

prom.codes Saver — cut token cost without cutting quality, as an MCP installer.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Starting the MCP server can alter existing AI-agent configuration files in the resolved workspace. Its setup tool can additionally create or update agent rule files; no install-time execution or credential exfiltration was found.

Static reason

No blocking static signals were detected.

Trigger

User starts the MCP binary; automatic mutation runs on startup, or an MCP client invokes setup.

Impact

Changes agent instruction/configuration behavior for detected runtimes in the selected workspace.

Mechanism

Default-on workspace AI-agent rule injection

Rationale

No malicious install hook, payload execution, exfiltration, or destructive behavior was found. The package nevertheless performs default-on mutation of AI-agent configuration at runtime, so it warrants a warning under the agent-extension lifecycle policy.

Evidence

package.jsondist/bin.jsREADME.mdCLAUDE.md.cursor/rules/prom-saver.mdc.augment/rules/prom-saver.mdAGENTS.md~/.prometheus/status/saver-<pid>.json~/.prometheus/.update-check-_prom.codes_saver.json

Network endpoints1

registry.npmjs.org/%40prom.codes%2Fsaver/latest

@prom.codes/saver@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code