@theronap/agnoclast-mcp@0.9.285
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe server automatically reads Codex’s identity token and sends it to Agnoclast on startup for accounts with confidential-brain seats. This is credential disclosure to a different service without a specific user request, so the package should be blocked.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The MCP server starts and the account has at least one confidential-brain seat.
Impact
An OpenAI Codex identity token is disclosed to the package vendor without a specific user request to share that token.
Mechanism
The package reads tokens.id_token from ~/.codex/auth.json and includes it as proof in a POST to the confidential-brain lookup endpoint.
Attack narrative
When the MCP server starts, it first checks whether the account has confidential-brain seats. If so, it reads Codex’s id_token from ~/.codex/auth.json and posts that token as account proof to Agnoclast. This automatically sends an identity credential issued for another service to the package vendor without a specific user request to share it.
AI rationale
The server automatically reads Codex’s identity token and sends it to Agnoclast on startup for accounts with confidential-brain seats. This is credential disclosure to a different service without a specific user request, so the package should be blocked.
Evidence
lib/server.mjslib/confidential_session.mjslib/diagnose.mjs~/.codex/auth.json
Network endpoints1
agnoclast.com/api/brains/confidential/mine
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The MCP server checks for confidential-brain seats during startup and, when seats exist, gathers an AI-account proof automatically.
- For Codex, the proof is the id_token read from ~/.codex/auth.json.
- The proof is posted to the Agnoclast confidential-brain endpoint.
- The default service host is https://agnoclast.com.
Evidence against
- The proof lookup is conditional on the account having confidential-brain seats.
- Claude Code API keys and cloud-provider credentials are refused rather than sent by this proof-gathering function.
- package.json declares no preinstall, install, or postinstall lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
16 flaggedlib/capture.mjsView file
•matchType = normalized_sha256
matchedPackage = @theronap/agnoclast-mcp@0.9.284
matchedPath = lib/capture.mjs
matchedIdentity = npm:QHRoZXJvbmFwL2Fnbm9jbGFzdC1tY3A:0.9.284
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L21: if (!res.ok) return null
L22: const j = await res.json().catch(() => ({}))
L23: return Array.isArray(j.types) ? j.types : null
...
L35: try {
L36: if (resolve(String(cwd)) === homedir()) return 'general'
L37: } catch { /* unresolvable path — fall through to basename */ }
...
L45: //
L46: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L47: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
14 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/channel.mjs
HighTrigger Reachable Persistencelib/editors/antigravity.mjs
HighSemantic Analysis Limitedbin/cortex-mcp.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritylib/confidential_session.mjs
HighKnown Malware Source Similaritylib/login.mjs
HighKnown Malware Source Similaritylib/capture.mjs
HighKnown Malware Source Similaritylib/edge_extract.mjs
HighKnown Malware Source Similaritylib/graphify_sync.mjs
HighKnown Malware Source Similaritylib/obligations_worker.mjs
HighKnown Malware Source Similaritylib/confidential_guard.mjs
High
Affected versions and remediation
This report applies to @theronap/agnoclast-mcp@0.9.285.
See all versions of @theronap/agnoclast-mcp for other recorded verdicts.
- Avoid installing @theronap/agnoclast-mcp@0.9.285. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.