registry / @solidrt/cli / 0.0.28

@solidrt/cli@0.0.28

AI Security Review

scanned 6h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time or import-time attack behavior was found. Explicit `srt init` installs a first-party MCP configuration, and the user-invoked dev server exposes development control and proxy capabilities.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `srt init`, `srt mcp`, or the development server.

Impact

A configured coding agent can save snapshots locally; a reachable dev server can proxy caller-selected URLs. No evidence shows stealth, exfiltration, or unconsented persistence.

Mechanism

First-party MCP bridge, local development control API, and configurable HTTP proxy.

Rationale

This is not malicious source, but it creates a first-party agent extension through an explicit setup command and exposes powerful development capabilities. Per the firewall policy, retain it as a warn rather than clean or block.

Evidence

package.jsonbin/srtsrc/main.tssrc/commands/init.tssrc/commands/mcp.tssrc/dev-server.tsserver/main.tsserver/proxy.tsscaffold/mcp.json.mcp.json

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`src/commands/init.ts` copies `scaffold/mcp.json` to a new project's `.mcp.json` during explicit `srt init`.
`scaffold/mcp.json` registers `srt mcp`, a package-owned stdio MCP server.
`src/commands/mcp.ts` writes PNG data to caller-supplied `save_to` paths.
`server/proxy.ts` forwards requests to the URL supplied in `X-SRT-Proxy-Url`.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
`bin/srt` only imports `src/main.ts`; actions dispatch from explicit CLI commands.
MCP control traffic targets loopback `127.0.0.1`; no external hard-coded endpoint or credential harvesting was found.
Project file routes use `resolveWithin` to constrain paths to the selected source directory.
Child processes run known Bun, Flux, TypeScript, chmod, or user-entered REPL commands; no hidden payload execution was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

Source & flagged code

1 flagged

src/util.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @solidrt/cli@0.0.26 matchedIdentity = npm:QHNvbGlkcnQvY2xp:0.0.26 similarity = 0.414 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/util.tsView on unpkg

Source & flagged code

1 flagged · loading source

src/util.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/util.tsView on unpkg

Findings

1 High3 Medium3 Low

HighPrevious Version Dangerous Deltasrc/util.ts

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings