registry / @theronap/cortex-mcp / 0.9.193
@theronap/cortex-mcp@0.9.193
Renamed to @theronap/agnoclast-mcp — use that. Existing installs switch themselves to the new name on next start.
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package has no npm install lifecycle hook, and the observed agent configuration is activated through explicit setup or install commands. Its first-party agent setup and guarded Antigravity launch-agent capability warrant a warning, but inspected source does not establish malicious behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the package's setup or install command; the Antigravity sync runs after watched changes once configured.
Impact
Agent behavior and background sync can be enabled for the user's account; the inspected source does not establish credential exfiltration or an unconsented npm-install mutation.
Mechanism
The package adds MCP and capture configuration and managed skills for supported agent environments, and can write an Antigravity sync script and launch agent.
AI rationale
The package has no npm install lifecycle hook, and the observed agent configuration is activated through explicit setup or install commands. Its first-party agent setup and guarded Antigravity launch-agent capability warrant a warning, but inspected source does not establish malicious behavior.
Evidence
lib/setup.mjslib/skills.mjslib/editors/antigravity.mjsbin/cortex-mcp.mjs
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- There are no npm lifecycle hooks; the manifest declares only release, promote, and rollback scripts.
- The editor adapters configure Cortex MCP and capture hooks for supported agent environments.
- The setup command writes agent configuration, and the skill installer targets Claude Code and Codex skill directories.
- The explicit install command wires detected editors; Antigravity setup writes a sync script and launch agent.
- Uninstall removes the package-managed agent configuration and skills; transcript lookup is limited to a session ID.
- The Antigravity sync is a guarded, package-owned integration that runs on watched changes and resolves its token at runtime.
Evidence against
- The package manifest has no preinstall, install, or postinstall hook, so these changes are not triggered by npm installation.
- The inspected source does not establish an unrelated credential recipient or a confirmed attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
6 flaggedlib/capture.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @theronap/cortex-mcp@0.9.150
matchedIdentity = npm:QHRoZXJvbmFwL2NvcnRleC1tY3A:0.9.150
similarity = 0.783
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L21: if (!res.ok) return null
L22: const j = await res.json().catch(() => ({}))
L23: return Array.isArray(j.types) ? j.types : null
...
L35: try {
L36: if (resolve(String(cwd)) === homedir()) return 'general'
L37: } catch { /* unresolvable path — fall through to basename */ }
...
L45: //
L46: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L47: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
4 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/uninstall.mjs
HighTrigger Reachable Persistencelib/editors/antigravity.mjs
HighSemantic Analysis Limitedbin/cortex-mcp.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/capture.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/editors/antigravity.mjs
LowScripts Present
LowWeak Cryptolib/capture.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @theronap/cortex-mcp@0.9.193.
See all versions of @theronap/cortex-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/cortex-mcp@0.9.193 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.