registry / @theronap/cortex-mcp / 0.9.149
@theronap/cortex-mcp@0.9.149
Renamed to @theronap/agnoclast-mcp — use that. Existing installs switch themselves to the new name on next start.
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package has no npm install lifecycle hook, but its explicit setup path persistently modifies broad AI-agent control surfaces and installs remotely supplied skills. That warrants a warning for agent-extension lifecycle risk rather than a publish block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the setup or install CLI command; configured hooks then run during agent sessions.
Impact
A configured user grants the package continuing access to agent control surfaces and sends captured session-derived content to its service.
Mechanism
Persistent agent configuration, hook installation, remote skill synchronization, and session ingest.
AI rationale
This package has no npm install lifecycle hook, but its explicit setup path persistently modifies broad AI-agent control surfaces and installs remotely supplied skills. That warrants a warning for agent-extension lifecycle risk rather than a publish block.
Evidence
lib/setup.mjslib/editors/claude.mjslib/skills.mjslib/capture.mjslib/diagnose.mjs~/.claude.json~/.claude/settings.json~/.codex/config.toml~/.codex/hooks.json~/.claude/skills~/.codex/skills~/.cortex/org-skills-cache.json
Network endpoints1
agnoclast.com
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An explicit setup command writes MCP configuration and persistent hooks for Claude and Codex.
- The Claude setup adds Stop, SessionStart, and UserPromptSubmit commands and pre-authorizes MCP tools.
- A SessionStart hook fetches authenticated organization-provided skills and writes them into detected agent skill directories.
- The capture hook reads a session transcript, redacts selected patterns, and uploads an ingest payload.
- The package uses agnoclast.com as its canonical service endpoint.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The control-surface changes are reached through explicit CLI setup or install commands, not package installation.
- The source contains credential-pattern redaction before capture data is sent.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
6 flaggedlib/capture.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @theronap/cortex-mcp@0.9.147
matchedIdentity = npm:QHRoZXJvbmFwL2NvcnRleC1tY3A:0.9.147
similarity = 0.909
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L17: if (!res.ok) return null
L18: const j = await res.json().catch(() => ({}))
L19: return Array.isArray(j.types) ? j.types : null
...
L31: try {
L32: if (resolve(String(cwd)) === homedir()) return 'general'
L33: } catch { /* unresolvable path — fall through to basename */ }
...
L41: //
L42: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L43: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
4 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/uninstall.mjs
HighTrigger Reachable Persistencelib/editors/antigravity.mjs
HighSemantic Analysis Limitedlib/diagnose.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/capture.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/editors/antigravity.mjs
LowScripts Present
LowWeak Cryptolib/capture.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @theronap/cortex-mcp@0.9.149.
See all versions of @theronap/cortex-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/cortex-mcp@0.9.149 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.