registry / @theronap/cortex-mcp / 0.9.206
@theronap/cortex-mcp@0.9.206
Renamed to @theronap/agnoclast-mcp — use that. Existing installs switch themselves to the new name on next start.
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package has no npm install lifecycle, and the inspected setup and uninstall behavior is reached through explicit commands. The Antigravity adapter creates a watcher that requires separate activation, so the guarded agent integration warrants a warning but does not establish a malicious attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the install/setup command and later explicitly loads the generated launch-agent plist.
Impact
This creates a guarded, package-owned agent integration that can run automatically after activation; the inspected source does not establish secret theft or an unrelated recipient.
Mechanism
The adapter writes a shell script and launch-agent plist; when activated, the watcher invokes the package's token wrapper to run a sync command after watched files change.
AI rationale
The package has no npm install lifecycle, and the inspected setup and uninstall behavior is reached through explicit commands. The Antigravity adapter creates a watcher that requires separate activation, so the guarded agent integration warrants a warning but does not establish a malicious attack.
Evidence
lib/editors/antigravity.mjslib/setup.mjslib/install.mjs
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines a command-line entrypoint and no npm lifecycle hook; its scripts are release, promote, and rollback.
- The command-line dispatcher reaches install and uninstall only when those subcommands are invoked.
- Setup requires a supplied token before wiring editor configuration.
- Antigravity setup writes a watcher script and launch-agent plist; the package says the watcher requires a separate launch command to activate.
- Codex and Cursor adapters write Cortex-specific configuration entries while preserving unrelated entries.
- Skills are installed under the user's Claude and Codex directories; uninstall is an explicit command that removes managed entries.
- Working-file and capture code reads project/session data for package functionality; inspected excerpts did not establish an unrelated exfiltration path.
Evidence against
- Antigravity's generated watcher can invoke the package with a token when activated, creating a guarded persistence capability that warrants a warning.
- The manifest has no automatic install lifecycle, and the Antigravity watcher is not activated by writing its files.
Source & flagged code
6 flaggedlib/capture.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @theronap/cortex-mcp@0.9.150
matchedIdentity = npm:QHRoZXJvbmFwL2NvcnRleC1tY3A:0.9.150
similarity = 0.739
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L21: if (!res.ok) return null
L22: const j = await res.json().catch(() => ({}))
L23: return Array.isArray(j.types) ? j.types : null
...
L35: try {
L36: if (resolve(String(cwd)) === homedir()) return 'general'
L37: } catch { /* unresolvable path — fall through to basename */ }
...
L45: //
L46: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L47: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
4 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/uninstall.mjs
HighTrigger Reachable Persistencelib/editors/antigravity.mjs
HighSemantic Analysis Limitedbin/cortex-mcp.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/capture.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/editors/antigravity.mjs
LowScripts Present
LowWeak Cryptolib/capture.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @theronap/cortex-mcp@0.9.206.
See all versions of @theronap/cortex-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/cortex-mcp@0.9.206 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.