registry / @theronap/agnoclast-mcp / 0.9.216
@theronap/agnoclast-mcp@0.9.216
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 25d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior. The flagged configuration writes are package-specific integration actions invoked through the CLI, and the capture path submits data to Cortex.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the package CLI setup or install command; capture runs through configured agent hooks.
Impact
These actions support the package's editor integration and data capture; inspected source did not establish an unrelated write or recipient.
Mechanism
Setup writes package-specific editor configuration, skills, and an Antigravity sync agent. Capture submits ingest data using the configured Cortex base and token.
AI rationale
Source inspection found no install lifecycle hook or concrete attack behavior. The flagged configuration writes are package-specific integration actions invoked through the CLI, and the capture path submits data to Cortex.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a CLI entrypoint and release, promote, and rollback scripts, with no install lifecycle hook.
- The bin entrypoint performs editor wiring only when the explicit install command is invoked.
- The Antigravity adapter writes its named sync script and launch agent as part of editor setup.
- Codex and Cursor adapters describe their integration boundaries; Cursor capture does not inject sibling-session context.
- Setup accepts a token argument, skills target Claude and Codex directories, and uninstall supports dry-run and backups.
- Capture posts collected ingest data to the configured Cortex base; the reviewed source shows no unrelated recipient.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedlib/capture.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @theronap/agnoclast-mcp@0.9.150
matchedIdentity = npm:QHRoZXJvbmFwL2Fnbm9jbGFzdC1tY3A:0.9.150
similarity = 0.717
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L21: if (!res.ok) return null
L22: const j = await res.json().catch(() => ({}))
L23: return Array.isArray(j.types) ? j.types : null
...
L35: try {
L36: if (resolve(String(cwd)) === homedir()) return 'general'
L37: } catch { /* unresolvable path — fall through to basename */ }
...
L45: //
L46: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L47: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
4 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/uninstall.mjs
HighTrigger Reachable Persistencelib/editors/antigravity.mjs
HighSemantic Analysis Limitedbin/cortex-mcp.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/capture.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/editors/antigravity.mjs
LowScripts Present
LowWeak Cryptolib/capture.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @theronap/agnoclast-mcp@0.9.216.
See all versions of @theronap/agnoclast-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/agnoclast-mcp@0.9.216 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.