registry / @theronap/agnoclast-mcp / 0.9.299
@theronap/agnoclast-mcp@0.9.299
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the reviewed credential flow sends Codex account proof to Agnoclast only for confidential-brain access. The flagged configuration writes and persistence are behind explicit commands, with closeout scheduling documented as off by default.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Starting the MCP server enables its service features; closeout scheduling and channel changes require explicit commands.
Impact
No unauthorized collection, persistence, or agent configuration change was identified.
Mechanism
Account proof is sent to Agnoclast when opening a named confidential brain. Optional closeout scheduling writes a launchd job, and channel selection updates existing agent configuration entries.
AI rationale
The package has no install lifecycle hook, and the reviewed credential flow sends Codex account proof to Agnoclast only for confidential-brain access. The flagged configuration writes and persistence are behind explicit commands, with closeout scheduling documented as off by default.
Evidence
package.jsonbin/cortex-mcp.mjslib/confidential_session.mjslib/server.mjslib/closeout.mjslib/channel.mjs
Network endpoints1
agnoclast.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install, preinstall, or postinstall hook; its scripts are release, promote, and rollback.
- The Codex id_token is read as account proof for confidential-brain access; the server requests a seat token when opening a named confidential brain, and sends it to the Agnoclast service.
- The closeout launchd job is off by default and is installed through the explicit closeout-install command.
- Channel configuration changes run through the explicit channel command.
Evidence against
- The package can read Codex authentication data and send account proof to its configured service for confidential-brain access.
- It can install a recurring background closeout job that reads eligible Claude Code transcripts and uses the user's Claude account.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
17 flaggedlib/capture.mjsView file
•matchType = normalized_sha256
matchedPackage = @theronap/agnoclast-mcp@0.9.293
matchedPath = lib/capture.mjs
matchedIdentity = npm:QHRoZXJvbmFwL2Fnbm9jbGFzdC1tY3A:0.9.293
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L21: if (!res.ok) return null
L22: const j = await res.json().catch(() => ({}))
L23: return Array.isArray(j.types) ? j.types : null
...
L35: try {
L36: if (resolve(String(cwd)) === homedir()) return 'general'
L37: } catch { /* unresolvable path — fall through to basename */ }
...
L45: //
L46: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L47: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
15 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/channel.mjs
HighTrigger Reachable Persistencelib/closeout.mjs
HighSemantic Analysis Limitedbin/cortex-mcp.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritylib/confidential_session.mjs
HighKnown Malware Source Similaritylib/login.mjs
HighKnown Malware Source Similaritylib/closeout.mjs
HighKnown Malware Source Similaritylib/capture.mjs
HighKnown Malware Source Similaritylib/edge_extract.mjs
HighKnown Malware Source Similaritylib/graphify_sync.mjs
HighKnown Malware Source Similaritylib/obligations_worker.mjs
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @theronap/agnoclast-mcp@0.9.299.
See all versions of @theronap/agnoclast-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/agnoclast-mcp@0.9.299 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.