registry / @sol-merrai/cli / 0.2.0

@sol-merrai/cli@0.2.0

Command-line client for Merrai

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `merrai auth logout` and confirms, or supplies `--yes`.

Impact

Can delete `~/.merrai-claude-code/credentials.json`; no exfiltration, remote execution, or stealth persistence was found.

Mechanism

Explicit credential cleanup including a legacy Claude Code path.

Rationale

Source inspection found no concrete malicious chain, but the explicit logout command mutates a legacy Claude Code credential location. Per policy, explicit user-command AI-agent config mutation is warned rather than blocked.

Evidence

package.jsondist/index.mjsdist/bin.mjsREADME.md~/.config/merrai/credentials.json~/.merrai-claude-code/credentials.json

Network endpoints1

api.merrai.app/rpc

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence with false-positive risk.

@sol-merrai/cli@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code