@theronap/cortex-mcp@0.9.215
Renamed to @theronap/agnoclast-mcp — use that. Existing installs switch themselves to the new name on next start.
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected persistence behavior is part of a first-party agent integration and is reached through explicit setup, so it warrants a warning under the agent integration policy. No concrete malicious behavior or install-time attack was established.
Decision evidence
public snapshot- package.json exposes a CLI and declares no npm install lifecycle hook.
- The CLI runs setup only for an explicit `setup` command; login reaches setup after browser-approved sign-in.
- Antigravity integration describes a launchd agent that watches its trajectory store and syncs when wired.
- The Antigravity adapter enables a capture hook and watch-based sync.
- No evidence inspected establishes an unconsented install-time configuration change or a confirmed attack.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkgPackage source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @theronap/cortex-mcp@0.9.215.
See all versions of @theronap/cortex-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/cortex-mcp@0.9.215 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.