registry  /  agent-hq-mcp  /  0.10.1

agent-hq-mcp@0.10.1

Local stdio MCP server that runs coding tasks through OpenCode or trusted CLI worker profiles.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `agent-hq register`, `agent-hq update`, console, or task-execution commands.
Impact
Can persist a package-owned MCP entry in selected user AI-agent hosts and execute operator-configured worker commands.
Mechanism
User-confirmed AI-agent registration and configured local CLI orchestration.
Rationale
No malicious install-time behavior, exfiltration, remote payload execution, or stealth persistence was found. Per policy, explicit user-command AI-agent configuration mutation is a warn-level capability risk.
Evidence
package.jsondist/register-cli.jsdist/update-cli.jsdist/runners/process.jsdist/runners/environment.jsdist/console-server.js~/.codex/config.toml~/.cursor/mcp.json
Network endpoints1
127.0.0.1

Decision evidence

public snapshot
AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `dist/register-cli.js` can modify Codex, Cursor, and Claude MCP registrations.
  • Registration changes require an interactive user confirmation with a default of no.
  • `dist/update-cli.js` explicitly runs global npm self-updates when invoked.
  • `dist/runners/process.js` spawns configured worker CLIs.
Evidence against
  • `package.json` has no preinstall, install, or postinstall lifecycle hook.
  • `dist/console-server.js` binds its authenticated console only to `127.0.0.1`.
  • `dist/runners/environment.js` filters worker environments to a small allowlist plus configured provider values.
  • No external exfiltration endpoint, eval/vm use, or stealth payload loading was found in inspected code.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 70 file(s), 973 KB of source, external domains: 127.0.0.1, alignment.anthropic.com, antigravity.google, arxiv.org, cursor.com, deepmind.google, opencode.ai, openrouter.ai, www.nature.com, www.w3.org

Source & flagged code

2 flagged · loading source
dist/console/fonts/archivo-variable-latin.woff2View file
•path = dist/console/fonts/archivo-variable-latin.woff2 kind = high_entropy_blob sizeBytes = 34940 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/console/fonts/archivo-variable-latin.woff2View on unpkg
dist/console-server.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = agent-hq-mcp@0.9.0 matchedIdentity = npm:YWdlbnQtaHEtbWNw:0.9.0 similarity = 0.785 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/console-server.jsView on unpkg

Findings

2 High3 Medium4 Low
HighShips High Entropy Blobdist/console/fonts/archivo-variable-latin.woff2
HighPrevious Version Dangerous Deltadist/console-server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings