registry  /  @usearete/mcp  /  0.2.0

@usearete/mcp@0.2.0

Arete MCP server (a4-mcp) - Model Context Protocol server for Arete streams

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Install-time code downloads a native executable, verifies a checksum fetched from the same release source, and stores it in `bin/`. The CLI later executes that executable with the caller's environment. No concrete exfiltration or AI-agent configuration mutation is present in the inspected package source.

Static reason
One or more suspicious static signals were detected.
Trigger
`npm install`/`npx` postinstall, then running `a4-mcp`
Impact
A compromised or redirected release artifact could execute as the installing user when the CLI is run.
Mechanism
postinstall remote native-binary download and CLI execution
Rationale
The source establishes an install-time remote executable delivery chain but not a concrete malicious payload or unconsented agent-control hijack. Flag as warn for the unresolved staged-binary risk rather than block.
Evidence
package.jsonscripts/postinstall.jsbin/a4-mcp.jsREADME.mdbin/a4-mcpbin/a4-mcp.exe
Network endpoints1
github.com/AreteA4/arete/releases/download/arete-mcp-v${version}

Decision evidence

public snapshot
AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `package.json` runs `postinstall` automatically.
  • `scripts/postinstall.js` downloads a platform binary during install.
  • The downloaded executable is written under `bin/` with executable permissions.
  • `bin/a4-mcp.js` executes that downloaded binary and forwards its environment.
  • Checksum verification fetches `checksums.txt` from the same release location.
  • Redirect handling permits up to five redirected download locations.
Evidence against
  • No credential, environment, or user-file harvesting appears in inspected JS.
  • No package code writes MCP client configuration or other AI-agent control surfaces.
  • No shell interpolation, eval, dynamic code loading, persistence, or destructive logic appears.
  • Downloads are restricted to a versioned Arete GitHub release URL before redirects.
  • The wrapper only invokes the selected local or PATH `a4-mcp` executable.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 6.75 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings