registry / @smart-coder-labs/nexusmind-mcp / 0.7.3

@smart-coder-labs/nexusmind-mcp@0.7.3

NexusMind MCP server for Claude Code and Cursor — team memory that persists across sessions

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs nexusmind setup and approves the resulting Codex hooks.

Impact

Agent-session content can be transmitted to the configured NexusMind service; the Stop hook can delay completion once per session.

Mechanism

User-invoked AI-agent hook installation and memory synchronization.

Rationale

Source confirms a user-invoked, persistent agent-extension setup with session-content transmission and a completion gate, but no lifecycle-triggered or covert malicious chain. Warn rather than block because Codex requires explicit hook approval and package installation alone is inert.

Evidence

package.jsondist/setup.jsdist/hooks/_helpers.jsdist/hooks/stop.jsdist/client.jsREADME.md

Network endpoints2

nexusmind-backend.fly.dev/v1/healthnexusmind-backend.fly.dev/v1/memory/store

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/setup.js explicitly writes Codex hook registrations and copies hook code to ~/.nexusmind/hook-runtime.
Configured hooks read Codex transcript data and send selected content to the NexusMind API.
dist/hooks/stop.js can emit a Codex block decision to keep a turn active.
Hooks default to nexusmind-backend.fly.dev when an API key is present.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Setup is an explicit interactive command; Codex hooks require separate user approval.
Child-process use is limited to codex registration/version checks and Windows setx.
No eval, downloaded code execution, credential harvesting, or unrelated exfiltration found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 19 file(s), 280 KB of source, external domains: github.com, nexusmind-backend.fly.dev

Source & flagged code

5 flagged

dist/hooks/_helpers.jsView file

Lines 1-25javascript

1// _helpers.ts — shared utilities for NexusMind Codex CLI hook handlers.

2// Every hook is a short-lived Node process invoked by Codex with a JSON payload

3// on stdin. These helpers keep that contract consistent: parse stdin, resolve

4// env config, detect the project, hit the backend with a hard timeout, and

5// format/emit output the way Codex expects.

6import { spawnSync } from 'node:child_process';

7import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

8import { readFile } from 'node:fs/promises';

9export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev';

10export const HEALTH_TIMEOUT_MS = 5000;

11export const FETCH_TIMEOUT_MS = 8000;

12export const STORE_TIMEOUT_MS = 10000;

13function envInt(name, fallback) {

14 const raw = process.env[name];

15 if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

16 return fallback;

17 const n = parseInt(raw, 10);

18 return Number.isFinite(n) && n > 0 ? n : fallback;

19}

20export const SESSION_PROJECT_LIMIT = envInt('NEXUSMIND_SESSION_PROJECT_LIMIT', 8);

21export const SESSION_RECENT_LIMIT = envInt('NEXUSMIND_SESSION_RECENT_LIMIT', 5);

22export const PROMPT_MEMORY_LIMIT = envInt('NEXUSMIND_PROMPT_MEMORY_LIMIT', 3);

23export const PROMPT_INJECT_MODE = (process.env.NEXUSMIND_PROMPT_INJECT ?? 'minimal').toLowerCase();

dist/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * nexusmind-mcp setup

4 * Interactively configures NexusMind for Claude Code, Cursor, or both.

5 *

6 * Usage:

7 * npx @smart-coder-labs/nexusmind-mcp setup

8 */

9import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';

10import { homedir } from 'node:os'

dist/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @smart-coder-labs/nexusmind-mcp@0.6.2 matchedIdentity = npm:[redacted]:0.6.2 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/doctor.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/hooks/_helpers.jsView file

5// format/emit output the way Codex expects. L6: import { spawnSync } from 'node:child_process'; L7: import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

5// format/emit output the way Codex expects. L6: import { spawnSync } from 'node:child_process'; L7: import { basename } from 'node:path'; L8: import { readFile } from 'node:fs/promises'; L9: export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev'; L10: export const HEALTH_TIMEOUT_MS = 5000; ... L13: function envInt(name, fallback) { L14: const raw = process.env[name]; L15: if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

dist/setup.jsView file

137return; L138: const res = spawnSync('setx', [name, value], { stdio: 'ignore', shell: true }); L139: if (!res.error && res.status === 0) {

High

Shell

Package source references shell execution.

dist/setup.jsView on unpkg · L137

13import * as readline from 'node:readline/promises'; L14: import { stdin as input, stdout as output } from 'node:process'; L15: import { spawnSync } from 'node:child_process'; L16: import { verifyCredentials, maskKey } from './verify.js'; L17: // ── Paths ───────────────────────────────────────────────────────────────────── L18: const HOME = homedir(); L19: const CLAUDE_JSON_PATH = join(HOME, '.claude.json'); ... L33: function codexHomeDir() { L34: return process.env.CODEX_HOME || join(HOME, '.codex'); L35: } ... L56: try { L57: return JSON.parse(readFileSync(path, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup.jsView on unpkg · L13

dist/doctor.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/doctor.jsView on unpkg

Findings

4 High3 Medium6 Low

HighChild Processdist/hooks/_helpers.js

HighShelldist/setup.js

HighSame File Env Network Executiondist/hooks/_helpers.js

HighPrevious Version Dangerous Deltadist/doctor.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/setup.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/hooks/_helpers.jsView file

Lines 1-25javascript

1// _helpers.ts — shared utilities for NexusMind Codex CLI hook handlers.

2// Every hook is a short-lived Node process invoked by Codex with a JSON payload

3// on stdin. These helpers keep that contract consistent: parse stdin, resolve

4// env config, detect the project, hit the backend with a hard timeout, and

5// format/emit output the way Codex expects.

6import { spawnSync } from 'node:child_process';

7import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

8import { readFile } from 'node:fs/promises';

9export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev';

10export const HEALTH_TIMEOUT_MS = 5000;

11export const FETCH_TIMEOUT_MS = 8000;

12export const STORE_TIMEOUT_MS = 10000;

13function envInt(name, fallback) {

14 const raw = process.env[name];

15 if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

16 return fallback;

17 const n = parseInt(raw, 10);

18 return Number.isFinite(n) && n > 0 ? n : fallback;

19}

20export const SESSION_PROJECT_LIMIT = envInt('NEXUSMIND_SESSION_PROJECT_LIMIT', 8);

21export const SESSION_RECENT_LIMIT = envInt('NEXUSMIND_SESSION_RECENT_LIMIT', 5);

22export const PROMPT_MEMORY_LIMIT = envInt('NEXUSMIND_PROMPT_MEMORY_LIMIT', 3);

23export const PROMPT_INJECT_MODE = (process.env.NEXUSMIND_PROMPT_INJECT ?? 'minimal').toLowerCase();

dist/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * nexusmind-mcp setup

4 * Interactively configures NexusMind for Claude Code, Cursor, or both.

5 *

6 * Usage:

7 * npx @smart-coder-labs/nexusmind-mcp setup

8 */

9import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';

10import { homedir } from 'node:os'

dist/doctor.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/doctor.jsView on unpkg

Lines 117-157javascript

117 lines.push(`export NEXUSMIND_BASE_URL="${baseUrl}"`);

118 }

119 if (lines.length) {

120 writeFileSync(rc, text + `\n# NexusMind\n${lines.join('\n')}\n`);

121 success(`Env vars → ${rc}`);

122 }

123 }

124}

125// Windows persistent env vars via setx, which writes HKCU\Environment (User

126// scope) so every future process inherits them. Without this, setup wrote only

127// to shell rc files that don't exist on Windows, leaving NEXUSMIND_BASE_URL

128// unset — so clients failed with "Missing environment variables:

129// NEXUSMIND_BASE_URL" when expanding the ${...} placeholders in their MCP

130// config. setx only affects processes started AFTER it runs, so the user must

131// restart their client (already the documented post-setup step); we also mirror

132// the values into process.env so any same-run check sees them. Values here (an

133// API key + a URL) are far under setx's ~1024-char limit.

134function writeWindowsEnv(apiKey, baseUrl) {

135 const setVar = (name, value) => {

136 if (!value)

137 return;

138 const res = spawnSync('setx', [name, value], { stdio: 'ignore', shell: true });

139 if (!res.error && res.status === 0) {

High

Shell

Package source references shell execution.

dist/setup.jsView on unpkg · L137

140 process.env[name] = value;

141 success(`Env var ${name} → Windows user environment`);

142 }

143 else {

144 warn(`Could not set ${name} automatically — run this yourself: setx ${name} "${value}"`);

145 }

146 };

147 setVar('NEXUSMIND_API_KEY', apiKey);

148 setVar('NEXUSMIND_BASE_URL', baseUrl);

149}

150// ── Install helpers ───────────────────────────────────────────────────────────

151// The Claude plugin is the canonical registration path for Claude Code — it owns

152// the MCP server entry and hooks. Setup no longer writes a user-level MCP server

153// registration (~/.claude.json or ~/.claude/settings.json) for Claude Code; it only

154// detects the plugin and guides the user to install it if missing.

155function isNexusmindPluginInstalled() {

156 const data = readJson(INSTALLED_PLUGINS_JSON);

157 if (existsSync(INSTALLED_PLUGINS_JSON) && !('plugins' in data)) {