@sentropic/h2a-runtime@0.91.1
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNot malicious: source inspection found no automatic install/import execution or concrete credential exfiltration chain. Warn because explicit cross-agent MCP registration is a dangerous capability.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs h2a plugin add (or related explicit plugin sync command).
Impact
A user-selected plugin gains configured MCP execution capability in Claude, Codex, and Gemini/AGY clients.
Mechanism
Explicit MCP installation and AI-agent configuration mutation.
AI rationale
Not malicious: source inspection found no automatic install/import execution or concrete credential exfiltration chain. Warn because explicit cross-agent MCP registration is a dangerous capability.
Evidence
package.jsondist/index.jsdist/plugin.jsdist/llm-mesh.jsdist/secrets.js~/.claude.json~/.codex/config.toml~/.gemini/config/mcp_config.json~/.sentropic/llm-mesh.json~/.sentropic/llm-mesh-token.json
Network endpoints3
oauth2.googleapis.com/tokenauth.openai.com/oauth/tokenlocalhost:3002
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/plugin.js: pluginAdd explicitly installs and registers MCP servers.
- dist/plugin.js: explicit plugin add writes ~/.claude.json, ~/.codex/config.toml, and ~/.gemini/config/mcp_config.json.
- dist/llm-mesh.js exports local credential readers and OAuth refresh helpers.
Evidence against
- package.json has no preinstall/install/postinstall scripts.
- dist/index.js wires MCP mutation only to explicit h2a plugin add commands.
- dist/index.js llm-mesh enrollment is an explicit CLI action; no import-time execution.
- dist/llm-mesh.js network calls shown are localhost gateway and provider OAuth refresh endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/tmux.jsView file
12*/
L13: import { spawn, spawnSync } from "node:child_process";
L14: import { createHash, randomUUID } from "node:crypto";
High
482const bin = c.split(" ")[0];
L483: if (spawnSync("command", ["-v", bin], { shell: true, stdio: "ignore" })
L484: .status === 0) {
High
dist/llm-mesh.js#virtual:normalized:round1View file
399return account;
L400: // Never send a non-OpenAI provider"s refresh token across provider\n // boundaries. In particular, Claude OAuth accounts are not refreshable here.\n if (account.provider !==...
L401: export function readGatewayPid(dir) {
High
Findings
2 Critical8 High3 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/llm-mesh.js
CriticalPrevious Version Dangerous Deltadist/llm-mesh.js
HighChild Processdist/tmux.js
HighShelldist/tmux.js
HighSame File Env Network Executiondist/llm-mesh.js#virtual:normalized:round1
HighCredential Exfiltrationdist/llm-mesh.js
HighCommand Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighTrigger Reachable Credential Exfiltrationdist/llm-mesh.js
HighTrigger Reachable Command Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
MediumNetwork
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.91.1.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.91.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.