@theronap/cortex-mcp@0.9.208
Renamed to @theronap/agnoclast-mcp — use that. Existing installs switch themselves to the new name on next start.
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected configuration and persistence behavior is tied to explicit CLI integration actions. The Antigravity launch agent is written but not loaded and is not configured to run at load, so the flagged source does not establish malicious persistence.
Decision evidence
public snapshot- package.json defines a CLI and has no preinstall, install, or postinstall hook.
- Agent configuration changes are implemented by explicit setup or install commands.
- The Antigravity adapter writes a launch agent but does not load it; its plist disables run-at-load.
- The reviewed files concern named Cortex integrations, capture, skills, and uninstall behavior; no concrete attack was identified.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkgPackage source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @theronap/cortex-mcp@0.9.208.
See all versions of @theronap/cortex-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/cortex-mcp@0.9.208 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.