registry / @twentytwohundred/2200-cli / 2026.702.2310

@twentytwohundred/2200-cli@2026.702.2310

A platform for hosting your fleet of always-on Agents.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Dangerous primitives are part of a user-invoked agent runtime and connector CLI, not install-time or hidden execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the 2200 CLI or starts its daemon/agent commands.

Impact

No evidence of unconsented credential harvesting, exfiltration, persistence, or destructive behavior beyond requested platform operations.

Mechanism

Package-aligned local agent supervisor, CLI, shell tool, OAuth/connectors, and update workflow

Rationale

Static inspection shows a feature-rich AI agent CLI with network, shell, credential vault, and daemon capabilities that are exposed through explicit commands and documented runtime flows. I found no lifecycle execution, hidden import-time behavior, or concrete unconsented exfiltration path.

Evidence

package.jsondist/index.jsdist/cli/main.jsdist/runtime/agent/bootstrap.jsdist/runtime/supervisor/bootstrap.jsdist/runtime/install/upgrade-runner.jsextensions-catalog/v1.json

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

Evidence against

package.json has no install/postinstall lifecycle scripts; bin is user-invoked dist/cli/main.js.
dist/index.js only reads package.json to export VERSION.
dist/cli/main.js commands create/start/manage a declared local agent platform, daemon, credentials, connectors, and updates.
dist/runtime/agent/bootstrap.js shell_run is an explicit agent tool bounded to the agent project dir.
dist/runtime/supervisor/bootstrap.js listeners default to 127.0.0.1 and package state under configured 2200 home.
Network endpoints are declared provider/platform APIs for LLMs, OAuth, search, Slack/Discord/Spotify, npm update, or localhost services.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 9 file(s), 4.15 MB of source, external domains: 100.x.x.x, 127.0.0.1, 192.168.1.42, accounts.google.com, accounts.spotify.com, aistudio.google.com, api.anthropic.com, api.deepseek.com, api.moonshot.ai, api.openai.com, api.search.brave.com, api.slack.com, api.telegram.org, api.x.ai, auth.x.ai, brave.com, developer.mozilla.org, developer.spotify.com, discord.com, discord.gg, discord.new, generativelanguage.googleapis.com, github.com, grok.com, jimmy.warting.se, nodejs.org, oauth2.googleapis.com, openpub.ai, openrouter.ai, react.dev, register.openscut.ai, registry.npmjs.org, slack.com, www.googleapis.com, www.w3.org

Oversized source lightweight scan

dist/connectors/discord/gateway.cjs3.00 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalHighEntropyStringsUrlStringsdeveloper.mozilla.orgdiscord.comdiscord.ggdiscord.newgithub.comjimmy.warting.se

Source & flagged code

6 flagged

dist/runtime/install/upgrade-runner.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from 'child_process';

3import { readFile, mkdir, open, rename, unlink } from 'fs/promises';

High

Child Process

Package source references child process execution.

dist/runtime/install/upgrade-runner.jsView on unpkg · L1

4import { dirname, join } from 'path';

5import { randomBytes } from 'crypto';

6import { z } from 'zod';

7import lockfile from 'proper-lockfile';

9function homePaths(home) {

10 const state = join(home, "state");

11 const config = join(home, "config");

12 return {

13 home,

14 commons: join(home, "commons"),

15 commonsReference: join(home, "commons", "reference"),

16 commonsScratch: join(home, "commons", "scratch"),

17 agents: join(home, "agents"),

18 sharedBrain: join(home, "shared", "brain"),

19 sharedBrainIndex: join(state, "brain", "__shared__", "brain.db"),

20 state,

21 stateSupervisorJson: join(state, "supervisor.json"),

dist/runtime/agent/bootstrap.jsView file

1import { hkdfSync, randomBytes, createHash, createCipheriv, createDecipheriv, randomUUID, sign, createPrivateKey, createPublicKey } from 'crypto'; L2: import { mkdir, writeFile, readFile, rm, readdir, appendFile, rename, chmod, stat, unlink, open } from 'fs/promises'; ... L6: import { stringify, parse } from 'yaml'; L7: import { createConnection } from 'net'; L8: import { homedir } from 'os'; L9: import { readFileSync, existsSync, mkdirSync } from 'fs'; L10: import { spawn } from 'child_process'; L11: import Database from 'better-sqlite3'; ... L201: tag: z.string(), L202: metadata: CredentialMetadataSchema L203: }); ... L3008: function activeLevel() {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

dist/runtime/supervisor/bootstrap.jsView file

3Detached bundled service listener: [redacted].js launches a Node helper and exposes a broad-bound HTTP listener. L3: import { z, ZodError } from 'zod'; L4: import { createDecipheriv, randomBytes, createCipheriv, generateKeyPairSync, timingSafeEqual, randomUUID, hkdfSync, sign, createHash, createPrivateKey, createPublicKey, scrypt } fr... L5: import * as YAML from 'yaml'; ... L12: import { fileURLToPath } from 'url'; L13: import { spawn, execFileSync } from 'child_process'; L14: import { McpServer } from '@[redacted].js'; ... L18: import { Buffer as Buffer$1 } from 'buffer'; L19: import { createServer } from 'net'; L20: import fastifyWebsocketImport from '@fastify/websocket'; ... L156: pid: join(root, "pub.pid"), L157: data: join(root, "data"), L158: adminSecret: join(root, "admin.secret"),

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/runtime/supervisor/bootstrap.jsView on unpkg · L3

dist/cli/main.jsView file

6Trigger-reachable chain: manifest.bin -> dist/cli/main.js L6: import { z, ZodError } from 'zod'; L7: import { createConnection, createServer } from 'net'; L8: import { randomBytes, hkdfSync, createCipheriv, createDecipheriv, createHash, randomUUID, timingSafeEqual, scrypt, generateKeyPairSync, sign, createPrivateKey, createPublicKey } fr... L9: import * as YAML from 'yaml'; ... L12: import lockfile from 'proper-lockfile'; L13: import { spawn, execFileSync } from 'child_process'; L14: import { CronExpressionParser } from 'cron-parser'; ... L231: pid: join(root, "pub.pid"), L232: data: join(root, "data"), L233: adminSecret: join(root, "admin.secret"), ... L1684: function activeLevel() { L1685: const raw = (process.env["LOG_LEVEL"] ?? "").toLowerCase();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/main.jsView on unpkg · L6

dist/connectors/discord/gateway.cjsView file

•path = dist/connectors/discord/gateway.cjs kind = oversized_source_file sizeBytes = 3142834 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connectors/discord/gateway.cjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/runtime/install/upgrade-runner.jsView file

1#!/usr/bin/env node L2: import { spawn } from 'child_process'; L3: import { readFile, mkdir, open, rename, unlink } from 'fs/promises';

High

Child Process

Package source references child process execution.

dist/runtime/install/upgrade-runner.jsView on unpkg · L1

dist/runtime/agent/bootstrap.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

dist/runtime/supervisor/bootstrap.jsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/runtime/supervisor/bootstrap.jsView on unpkg · L3

dist/cli/main.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/main.jsView on unpkg · L6

dist/connectors/discord/gateway.cjsView file

•path = dist/connectors/discord/gateway.cjs kind = oversized_source_file sizeBytes = 3142834 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connectors/discord/gateway.cjsView on unpkg

Findings

2 Critical4 High3 Medium8 Low

CriticalCommand Output Exfiltrationdist/runtime/agent/bootstrap.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/main.js

HighChild Processdist/runtime/install/upgrade-runner.js

HighShell

HighSpawned Bundled Service Listenerdist/runtime/supervisor/bootstrap.js

HighOversized Source Filedist/connectors/discord/gateway.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/runtime/agent/bootstrap.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

86%Pass

Verdict confidence

IntentBenign

False-positive riskMedium

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTWENTYTWOHUNDRED LLC

Maintainersdhardman2200

Version2026.710.904

PublishedJul 2, 2026

LicenseSEE LICENSE IN LICENSE

Dependencies18

Integrityverified

Package size4.26 MB

Files32

Keywordsagentagentsaillmfleetruntimescutopenpub

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsbin → 2200

Runtimenode >=22.0.0pnpm >=9.0.0

Artifact18.7 MB · 32 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, bundle:connectors, bundle:pub-server-patch, bundle:web +8

Behavioral surface

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedTelemetryUrlStringsNoLicense

Source & flagged code

6 flagged

dist/runtime/install/upgrade-runner.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from 'child_process';

3import { readFile, mkdir, open, rename, unlink } from 'fs/promises';

High

Child Process

Package source references child process execution.

dist/runtime/install/upgrade-runner.jsView on unpkg · L1

4import { dirname, join } from 'path';

5import { randomBytes } from 'crypto';

6import { z } from 'zod';

7import lockfile from 'proper-lockfile';

9function homePaths(home) {

10 const state = join(home, "state");

11 const config = join(home, "config");

12 return {

13 home,

14 commons: join(home, "commons"),

15 commonsReference: join(home, "commons", "reference"),

16 commonsScratch: join(home, "commons", "scratch"),

17 agents: join(home, "agents"),

18 sharedBrain: join(home, "shared", "brain"),

19 sharedBrainIndex: join(state, "brain", "__shared__", "brain.db"),

20 state,

21 stateSupervisorJson: join(state, "supervisor.json"),

dist/runtime/agent/bootstrap.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/agent/bootstrap.jsView on unpkg · L1

dist/runtime/supervisor/bootstrap.jsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/runtime/supervisor/bootstrap.jsView on unpkg · L3

dist/cli/main.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/main.jsView on unpkg · L6

dist/connectors/discord/gateway.cjsView file

•path = dist/connectors/discord/gateway.cjs kind = oversized_source_file sizeBytes = 3142834 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connectors/discord/gateway.cjsView on unpkg