registry / @trustbaseai/collab-mcp / 0.15.2

@trustbaseai/collab-mcp@0.15.2

Multi-AI collaboration MCP server - core communication layer

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package runs a local collaboration HTTP/MCP server and can optionally configure a package-owned OS autostart service after an explicit CLI command.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `collab-mcp install`, `collab-mcp start`, or `collab-mcp autostart enable`.

Impact

Creates local application state and, when explicitly requested, a user-level service or scheduled task.

Mechanism

Local config/SQLite server with explicit user-service setup.

Rationale

Direct source inspection found no install-time execution, credential harvesting, outbound exfiltration, remote payload loading, or unconsented AI-agent control-surface mutation. The flagged persistence primitives are explicit user-invoked setup for this package's own local server.

Evidence

package.jsonbin/collab-mcp.jssrc/cli-install.jssrc/cli-autostart.jssrc/service-linux.jssrc/service-windows.jssrc/server.jssrc/config-store.js~/.collab-mcp/config.json~/.collab-mcp/collab.db~/.config/systemd/user/collab-mcp.service~/.collab-mcp/bin/service-start.bat

@trustbaseai/collab-mcp@0.15.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code