@theronap/cortex-mcp@0.9.216
Renamed to @theronap/agnoclast-mcp — use that. Existing installs switch themselves to the new name on next start.
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected configuration and persistence behavior belongs to CLI setup or uninstall flows. The reviewed source does not establish a concrete attack surface.
Decision evidence
public snapshot- package.json defines a CLI entrypoint and no preinstall, install, or postinstall hook.
- The agent configuration and skill files contain package-specific editor or skill setup behavior.
- Antigravity persistence writes are implemented in an editor setup module, not as an npm lifecycle hook.
- Uninstall behavior is reached through the explicit uninstall command.
- The capture module contains session extraction and capture support.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkgPackage source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @theronap/cortex-mcp@0.9.216.
See all versions of @theronap/cortex-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/cortex-mcp@0.9.216 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.