@theronap/agnoclast-mcp@0.9.284
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe server automatically forwards a Codex id_token to Agnoclast during startup for users with confidential seats. Because this is an authentication token from another service and the transfer occurs without an explicit action for that request, this meets the credential-exfiltration rule.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Default MCP server startup when the account has confidential seats.
Impact
Exposes an authentication identity token from another service to the package vendor without an explicit user action for that request.
Mechanism
Reads the Codex id_token from auth.json, then includes it in an automatic account-proof request to the package service.
Attack narrative
For Codex users who hold confidential seats, the default server startup reads the id_token from ~/.codex/auth.json and sends it as proof to Agnoclast's confidential-seat endpoint. This happens during startup, before a user names a confidential brain in a tool call. The token is intended for account verification, but it is still an authentication token from another service sent to the package vendor without a request-specific user action.
AI rationale
The server automatically forwards a Codex id_token to Agnoclast during startup for users with confidential seats. Because this is an authentication token from another service and the transfer occurs without an explicit action for that request, this meets the credential-exfiltration rule.
Evidence
lib/confidential_session.mjslib/server.mjslib/diagnose.mjs~/.codex/auth.json
Network endpoints1
agnoclast.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- Codex account proof reads the id_token from ~/.codex/auth.json.
- The default MCP server startup checks for confidential seats; when seats exist, it gathers and sends the AI account proof automatically.
- The proof is posted to the package service at https://agnoclast.com/api/brains/confidential/mine.
- The request body includes the proof, which contains the Codex id_token.
- There are no npm lifecycle scripts.
- Antigravity wiring is an explicit install action and does not load its generated launchd agent.
Evidence against
- The account proof flow is implemented for confidential-seat account verification.
- The Antigravity persistence finding is not activated automatically by the adapter.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggedlib/capture.mjsView file
•matchType = normalized_sha256
matchedPackage = @theronap/cortex-mcp@0.9.281
matchedPath = lib/capture.mjs
matchedIdentity = npm:QHRoZXJvbmFwL2NvcnRleC1tY3A:0.9.281
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L21: if (!res.ok) return null
L22: const j = await res.json().catch(() => ({}))
L23: return Array.isArray(j.types) ? j.types : null
...
L35: try {
L36: if (resolve(String(cwd)) === homedir()) return 'general'
L37: } catch { /* unresolvable path — fall through to basename */ }
...
L45: //
L46: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L47: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
13 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/channel.mjs
HighTrigger Reachable Persistencelib/editors/antigravity.mjs
HighSemantic Analysis Limitedbin/cortex-mcp.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritylib/login.mjs
HighKnown Malware Source Similaritylib/capture.mjs
HighKnown Malware Source Similaritylib/edge_extract.mjs
HighKnown Malware Source Similaritylib/graphify_sync.mjs
HighKnown Malware Source Similaritylib/obligations_worker.mjs
HighKnown Malware Source Similaritylib/confidential_guard.mjs
HighKnown Malware Source Similaritylib/obligation_review.mjs
High
Affected versions and remediation
This report applies to @theronap/agnoclast-mcp@0.9.284.
See all versions of @theronap/agnoclast-mcp for other recorded verdicts.
- Avoid installing @theronap/agnoclast-mcp@0.9.284. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.