registry / @twentytwohundred/2200-cli / 2026.702.2247

@twentytwohundred/2200-cli@2026.702.2247

A platform for hosting your fleet of always-on Agents.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is an AI agent runtime/CLI with powerful user-invoked daemon, tool, connector, upgrade, and web API features that match its documented purpose.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User invokes the 2200 CLI, starts the daemon, creates/runs agents, installs connectors, or requests an upgrade.

Impact

Could execute commands or send data only through configured agent tools, connectors, model providers, or authenticated/local runtime APIs.

Mechanism

Package-aligned agent runtime with explicit shell/network/daemon capabilities

Rationale

Static source inspection shows high-risk primitives, but they are explicit runtime features of an agent hosting CLI rather than hidden install/import-time behavior. I found no unconsented exfiltration, credential theft, destructive install hook, or unauthorized AI-agent control mutation.

Evidence

package.jsondist/cli/main.jsdist/runtime/agent/bootstrap.jsdist/runtime/supervisor/bootstrap.jsdist/runtime/install/upgrade-runner.jsdist/vendor/openpub-pub-server/server.js

Network endpoints10

api.anthropic.comapi.openai.comapi.deepseek.comapi.x.aigenerativelanguage.googleapis.comapi.search.brave.comwww.googleapis.comregistry.npmjs.orgopenpub.aiwss://openpub.ai/ws/pub

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/runtime/agent/bootstrap.js exposes agent tools including shell_run and HTTP/web search.
dist/runtime/supervisor/bootstrap.js can start daemons, agents, gateways, and a web API listener.
dist/runtime/install/upgrade-runner.js runs npm install -g during explicit upgrade flow.

Evidence against

package.json has no install/postinstall lifecycle hooks; prepack is publish-time only.
dist/cli/main.js only parses commands when invoked directly as the 2200 bin.
dist/runtime/agent/bootstrap.js requires TWENTYTWOHUNDRED_* env vars and is launched by supervisor, not import-time.
shell_run is a declared agent tool bounded to the agent project directory and returns results to the configured LLM provider as product behavior.
Supervisor/API routes use local state, bearer auth, or loopback health checks; network use is package-aligned.
No credential harvesting, hidden exfil endpoint, persistence outside app daemon state, or AI-agent control-surface mutation at install time found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 9 file(s), 4.15 MB of source, external domains: 100.x.x.x, 127.0.0.1, 192.168.1.42, accounts.google.com, accounts.spotify.com, aistudio.google.com, api.anthropic.com, api.deepseek.com, api.moonshot.ai, api.openai.com, api.search.brave.com, api.slack.com, api.telegram.org, api.x.ai, auth.x.ai, brave.com, developer.mozilla.org, developer.spotify.com, discord.com, discord.gg, discord.new, generativelanguage.googleapis.com, github.com, grok.com, jimmy.warting.se, nodejs.org, oauth2.googleapis.com, openpub.ai, openrouter.ai, react.dev, register.openscut.ai, registry.npmjs.org, slack.com, www.googleapis.com, www.w3.org

Oversized source lightweight scan

dist/connectors/discord/gateway.cjs3.00 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalHighEntropyStringsUrlStringsdeveloper.mozilla.orgdiscord.comdiscord.ggdiscord.newgithub.comjimmy.warting.se

Source & flagged code

6 flagged

dist/runtime/install/upgrade-runner.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from 'child_process';

3import { readFile, mkdir, open, rename, unlink } from 'fs/promises';

High

Child Process

Package source references child process execution.

dist/runtime/install/upgrade-runner.jsView on unpkg · L1

4import { dirname, join } from 'path';

5import { randomBytes } from 'crypto';

6import { z } from 'zod';

7import lockfile from 'proper-lockfile';

9function homePaths(home) {

10 const state = join(home, "state");

11 const config = join(home, "config");

12 return {

13 home,

14 commons: join(home, "commons"),

15 commonsReference: join(home, "commons", "reference"),

16 commonsScratch: join(home, "commons", "scratch"),

17 agents: join(home, "agents"),

18 sharedBrain: join(home, "shared", "brain"),

19 sharedBrainIndex: join(state, "brain", "__shared__", "brain.db"),

20 state,

21 stateSupervisorJson: join(state, "supervisor.json"),

dist/runtime/agent/bootstrap.jsView file

1import { hkdfSync, randomBytes, createHash, createCipheriv, createDecipheriv, randomUUID, sign, createPrivateKey, createPublicKey } from 'crypto'; L2: import { mkdir, writeFile, readFile, rm, readdir, appendFile, rename, chmod, stat, unlink, open } from 'fs/promises'; ... L6: import { stringify, parse } from 'yaml'; L7: import { createConnection } from 'net'; L8: import { homedir } from 'os'; L9: import { readFileSync, existsSync, mkdirSync } from 'fs'; L10: import { spawn } from 'child_process'; L11: import Database from 'better-sqlite3'; ... L201: tag: z.string(), L202: metadata: CredentialMetadataSchema L203: }); ... L3008: function activeLevel() {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

dist/runtime/supervisor/bootstrap.jsView file

3Detached bundled service listener: [redacted].js launches a Node helper and exposes a broad-bound HTTP listener. L3: import { z, ZodError } from 'zod'; L4: import { createDecipheriv, randomBytes, createCipheriv, generateKeyPairSync, timingSafeEqual, randomUUID, hkdfSync, sign, createHash, createPrivateKey, createPublicKey, scrypt } fr... L5: import * as YAML from 'yaml'; ... L12: import { fileURLToPath } from 'url'; L13: import { spawn, execFileSync } from 'child_process'; L14: import { McpServer } from '@[redacted].js'; ... L18: import { Buffer as Buffer$1 } from 'buffer'; L19: import { createServer } from 'net'; L20: import fastifyWebsocketImport from '@fastify/websocket'; ... L156: pid: join(root, "pub.pid"), L157: data: join(root, "data"), L158: adminSecret: join(root, "admin.secret"),

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/runtime/supervisor/bootstrap.jsView on unpkg · L3

dist/cli/main.jsView file

6Trigger-reachable chain: manifest.bin -> dist/cli/main.js L6: import { z, ZodError } from 'zod'; L7: import { createConnection, createServer } from 'net'; L8: import { randomBytes, hkdfSync, createCipheriv, createDecipheriv, createHash, randomUUID, timingSafeEqual, scrypt, generateKeyPairSync, sign, createPrivateKey, createPublicKey } fr... L9: import * as YAML from 'yaml'; ... L12: import lockfile from 'proper-lockfile'; L13: import { spawn, execFileSync } from 'child_process'; L14: import { CronExpressionParser } from 'cron-parser'; ... L231: pid: join(root, "pub.pid"), L232: data: join(root, "data"), L233: adminSecret: join(root, "admin.secret"), ... L1684: function activeLevel() { L1685: const raw = (process.env["LOG_LEVEL"] ?? "").toLowerCase();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/main.jsView on unpkg · L6

dist/connectors/discord/gateway.cjsView file

•path = dist/connectors/discord/gateway.cjs kind = oversized_source_file sizeBytes = 3142834 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connectors/discord/gateway.cjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/runtime/install/upgrade-runner.jsView file

1#!/usr/bin/env node L2: import { spawn } from 'child_process'; L3: import { readFile, mkdir, open, rename, unlink } from 'fs/promises';

High

Child Process

Package source references child process execution.

dist/runtime/install/upgrade-runner.jsView on unpkg · L1

dist/runtime/agent/bootstrap.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

dist/runtime/supervisor/bootstrap.jsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/runtime/supervisor/bootstrap.jsView on unpkg · L3

dist/cli/main.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/main.jsView on unpkg · L6

dist/connectors/discord/gateway.cjsView file

•path = dist/connectors/discord/gateway.cjs kind = oversized_source_file sizeBytes = 3142834 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connectors/discord/gateway.cjsView on unpkg

Findings

2 Critical4 High3 Medium8 Low

CriticalCommand Output Exfiltrationdist/runtime/agent/bootstrap.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/main.js

HighChild Processdist/runtime/install/upgrade-runner.js

HighShell

HighSpawned Bundled Service Listenerdist/runtime/supervisor/bootstrap.js

HighOversized Source Filedist/connectors/discord/gateway.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/runtime/agent/bootstrap.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

82%Pass

Verdict confidence

IntentBenign

False-positive riskMedium

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTWENTYTWOHUNDRED LLC

Maintainersdhardman2200

Version2026.710.904

PublishedJul 2, 2026

LicenseSEE LICENSE IN LICENSE

Dependencies18

Integrityverified

Package size4.25 MB

Files32

Keywordsagentagentsaillmfleetruntimescutopenpub

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsbin → 2200

Runtimenode >=22.0.0pnpm >=9.0.0

Artifact18.7 MB · 32 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, bundle:connectors, bundle:pub-server-patch, bundle:web +8

Behavioral surface

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedTelemetryUrlStringsNoLicense

Source & flagged code

6 flagged

dist/runtime/install/upgrade-runner.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from 'child_process';

3import { readFile, mkdir, open, rename, unlink } from 'fs/promises';

High

Child Process

Package source references child process execution.

dist/runtime/install/upgrade-runner.jsView on unpkg · L1

4import { dirname, join } from 'path';

5import { randomBytes } from 'crypto';

6import { z } from 'zod';

7import lockfile from 'proper-lockfile';

9function homePaths(home) {

10 const state = join(home, "state");

11 const config = join(home, "config");

12 return {

13 home,

14 commons: join(home, "commons"),

15 commonsReference: join(home, "commons", "reference"),

16 commonsScratch: join(home, "commons", "scratch"),

17 agents: join(home, "agents"),

18 sharedBrain: join(home, "shared", "brain"),

19 sharedBrainIndex: join(state, "brain", "__shared__", "brain.db"),

20 state,

21 stateSupervisorJson: join(state, "supervisor.json"),

dist/runtime/agent/bootstrap.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

dist/runtime/supervisor/bootstrap.jsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/runtime/supervisor/bootstrap.jsView on unpkg · L3

dist/cli/main.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/main.jsView on unpkg · L6

dist/connectors/discord/gateway.cjsView file

•path = dist/connectors/discord/gateway.cjs kind = oversized_source_file sizeBytes = 3142834 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connectors/discord/gateway.cjsView on unpkg