registry / @theronap/cortex-mcp / 0.9.47

@theronap/cortex-mcp@0.9.47

Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 225 KB of source, external domains: cortex-console.vercel.app, www.apple.com

Source & flagged code

3 flagged

lib/capture.mjsView file

Lines 1-21javascript

1import { readFileSync } from 'fs'

2import { spawn } from 'child_process'

3import { homedir } from 'os'

4import { resolve, dirname, join } from 'path'

5import { fileURLToPath } from 'url'

6import { createHash } from 'crypto'

7import { fetchCortex, classify, resolveBase, readWiredToken } from './diagnose.mjs'

8import { extractSession } from './edge_extract.mjs'

9import { extractTyped } from './extract_typed.mjs'

10import { redactSecrets } from './redact.mjs'

12// Fetch the node-type registry (global + this org's custom types) — the catalog the typed extractor

13// produces against. Best-effort: null on any failure (typed extraction is then skipped, never blocks capture).

14async function fetchRegistry(base, token) {

15 try {

16 const res = await fetchCortex(`${base}/api/node-types`, { headers: { Authorization: `Bearer ${token}` } })

17 if (!res.ok) return null

18 const j = await res.json().catch(() => ({}))

19 return Array.isArray(j.types) ? j.types : null

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/capture.mjsView on unpkg · L1

20 } catch {

21 return null

lib/uninstall.mjsView file

Lines 1-23javascript

1import { readFileSync, writeFileSync, existsSync, copyFileSync, rmSync } from 'fs'

2import { homedir } from 'os'

3import { join } from 'path'

4import { execFileSync } from 'child_process'

6// Full uninstall — the reverse of setup.mjs. Removes EVERY touch-point Cortex writes onto a machine:

7// 1. ~/.claude.json → mcpServers.cortex

8// 2. ~/.claude/settings.json → Stop/SessionStart/PreCompact cortex hooks

lib/graphify_sync.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @theronap/cortex-mcp@0.9.45 matchedIdentity = npm:QHRoZXJvbmFwL2NvcnRleC1tY3A:0.9.45 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/graphify_sync.mjsView on unpkg

Source & flagged code

3 flagged · loading source

lib/capture.mjsView file

1import { readFileSync } from 'fs' L2: import { spawn } from 'child_process' L3: import { homedir } from 'os' ... L17: if (!res.ok) return null L18: const j = await res.json().catch(() => ({})) L19: return Array.isArray(j.types) ? j.types : null ... L31: try { L32: if (resolve(String(cwd)) === homedir()) return 'general' L33: } catch { /* unresolvable path — fall through to basename */ } ... L94: // recurse (and re-ingest the summarizer's prompt as a phantom session). Bail immediately. L95: if (process.env.CORTEX_SUMMARIZING) { process.stderr.write('cortex: summarizer subprocess, skipping\n'); return } L96:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/capture.mjsView on unpkg · L1

lib/uninstall.mjsView file

3import { join } from 'path' L4: import { execFileSync } from 'child_process' L5: ... L12: // 6. launchd agent → ~/Library/LaunchAgents/com.cortex.*.plist (unload + remove) L13: // 7. crontab → lines tagged "# cortex ..." L14: // 8. off-switch env → launchctl unsetenv CORTEX_SUMMARIZE_DISABLED (macOS) ... L20: L21: const HOME = homedir() L22: const CLAUDE_JSON = join(HOME, '.claude.json') ... L36: L37: process.stdout.write(dry ? '\nCortex uninstall — DRY RUN (nothing will change):\n\n' : '\nCortex uninstall — removing all wiring…\n\n') L38:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/uninstall.mjsView on unpkg · L3

lib/graphify_sync.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/graphify_sync.mjsView on unpkg

Findings

1 High3 Medium4 Low

HighPrevious Version Dangerous Deltalib/graphify_sync.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/uninstall.mjs

LowWeak Cryptolib/capture.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

lib/capture.mjsView file

Lines 1-21javascript

1import { readFileSync } from 'fs'

2import { spawn } from 'child_process'

3import { homedir } from 'os'

4import { resolve, dirname, join } from 'path'

5import { fileURLToPath } from 'url'

6import { createHash } from 'crypto'

7import { fetchCortex, classify, resolveBase, readWiredToken } from './diagnose.mjs'

8import { extractSession } from './edge_extract.mjs'

9import { extractTyped } from './extract_typed.mjs'

10import { redactSecrets } from './redact.mjs'

12// Fetch the node-type registry (global + this org's custom types) — the catalog the typed extractor

13// produces against. Best-effort: null on any failure (typed extraction is then skipped, never blocks capture).

14async function fetchRegistry(base, token) {

15 try {

16 const res = await fetchCortex(`${base}/api/node-types`, { headers: { Authorization: `Bearer ${token}` } })

17 if (!res.ok) return null

18 const j = await res.json().catch(() => ({}))

19 return Array.isArray(j.types) ? j.types : null

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/capture.mjsView on unpkg · L1

20 } catch {

21 return null

lib/uninstall.mjsView file

Lines 1-23javascript

1import { readFileSync, writeFileSync, existsSync, copyFileSync, rmSync } from 'fs'

2import { homedir } from 'os'

3import { join } from 'path'

4import { execFileSync } from 'child_process'

6// Full uninstall — the reverse of setup.mjs. Removes EVERY touch-point Cortex writes onto a machine:

7// 1. ~/.claude.json → mcpServers.cortex

8// 2. ~/.claude/settings.json → Stop/SessionStart/PreCompact cortex hooks

lib/graphify_sync.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/graphify_sync.mjsView on unpkg