registry / AI-agent control-surface risk / agent-nervous-system-mcp

agent-nervous-system-mcp

Shared context MCP for AI agents - append-only, zero config, auto-detect

This report shows the evidence for agent-nervous-system-mcp@2.0.0. 5 of 7 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The postinstall hook mutates detected agent configurations without consent in non-interactive environments. This supports blocking under the AI-agent control-surface policy.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Package installation runs the postinstall hook; when stdin is not a TTY, the hook selects all detected agents.

Impact

Agent configurations are changed during installation, enabling this package's server in those agents.

Mechanism

The hook adds an MCP server entry to detected agent configurations and writes the modified files.

Policy narrative

Installation automatically runs the setup script. In non-interactive mode, it selects all detected agents and writes an MCP server entry into their configuration files, without asking the user to approve those changes. This is an unconsented install-time mutation of AI-agent control surfaces.

AI rationale

The postinstall hook mutates detected agent configurations without consent in non-interactive environments. This supports blocking under the AI-agent control-surface policy.

Evidence

package.jsonscripts/postinstall.js~/.claude.json~/.cursor/mcp.json~/.config/opencode/opencode.json~/.vscode/mcp.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js automatically during installation.
In non-interactive mode, the installer selects every detected agent without asking the user.
The installer detects agent configuration files across the user's home directory.
It adds this package as an MCP server in those agent configurations.
It writes the modified configurations to disk.

Evidence against

Interactive mode asks which agents to configure.

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 37.1 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-32json

2 "name": "agent-nervous-system-mcp",

3 "version": "2.0.0",

4 "description": "Shared context MCP for AI agents - append-only, zero config, auto-detect",

5 "main": "dist/index.js",

6 "bin": {

7 "agent-nervous-system-mcp": "dist/index.js",

8 "agent-nervous-system-mcp-setup": "scripts/postinstall.js"

9 },

10 "scripts": {

11 "build": "tsc",

12 "start": "node dist/index.js",

13 "prepublishOnly": "npm run build",

14 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "keywords": ["mcp", "shared-context", "agent-memory", "ai", "common-context"],

17 "author": "",

High

Suspicious Lifecycle Evidence

package.json runs scripts/postinstall.js automatically during installation.

package.jsonView on unpkg · L14

18 "license": "MIT",

19 "dependencies": {

20 "@modelcontextprotocol/sdk": "^1.29.0",

21 "zod": "^3.23.0"

22 },

23 "devDependencies": {

24 "typescript": "^5.0.0",

25 "@types/node": "^20.0.0"

26 },

27 "files": ["dist/", "scripts/", "README.md"],

28 "engines": {

29 "node": ">=18.0.0"

30 }

31}

scripts/postinstall.jsView file

Lines 3-43javascript

3const path = require("path");

4const os = require("os");

5const readline = require("readline");

6const { execSync } = require("child_process");

8const HOME = os.homedir();

10const MCP_ENTRY_STANDARD = { command: "agent-nervous-system-mcp" };

11const MCP_ENTRY_OPENCODE = { type: "local", command: ["agent-nervous-system-mcp"] };

13function commandExists(cmd) {

14 try {

15 execSync(`command -v ${cmd} 2>/dev/null`, { stdio: "ignore" });

16 return true;

17 } catch (e) {

18 return false;

19 }

20}

22// Expanded agent list - 20+ AI agents/tools

23const AGENTS = [

24 { name: "Claude Code", path: path.join(HOME, ".claude.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".claude.json")) || commandExists("claude") },

25 { name: "Claude Desktop (macOS)", path: path.join(HOME, "Library", "Application Support", "Claude", "claude_desktop_config.json"), format: "mcpServers", detect: () => process.platform === "darwin" && fs.existsSync(path.join(HOME, "Library", "Application Support", "Claude")) },

High

Ai Review Evidence

The installer detects agent configuration files across the user's home directory.

scripts/postinstall.jsView on unpkg · L23

26 { name: "Claude Desktop (Linux)", path: path.join(HOME, ".config", "Claude", "claude_desktop_config.json"), format: "mcpServers", detect: () => process.platform === "linux" && fs.existsSync(path.join(HOME, ".config", "Claude")) },

27 { name: "Cursor", path: path.join(HOME, ".cursor", "mcp.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".cursor")) || commandExists("cursor") },

28 { name: "OpenCode", path: path.join(HOME, ".config", "opencode", "opencode.json"), format: "opencode", detect: () => fs.existsSync(path.join(HOME, ".config", "opencode")) || commandExists("opencode") },

29 { name: "Windsurf", path: path.join(HOME, ".codeium", "windsurf", "mcp_config.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".codeium", "windsurf")) || commandExists("windsurf") },

30 { name: "Cline (VS Code)", path: path.join(HOME, ".vscode", "mcp.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".vscode")) || commandExists("code") },

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

31 { name: "Continue", path: path.join(HOME, ".continue", "config.json"), format: "continue", detect: () => fs.existsSync(path.join(HOME, ".continue")) },

32 { name: "Zed", path: path.join(HOME, ".config", "zed", "settings.json"), format: "zed", detect: () => fs.existsSync(path.join(HOME, ".config", "zed")) || commandExists("zed") },

33 { name: "Aider", path: path.join(HOME, ".aider.conf.yml"), format: "aider", detect: () => fs.existsSync(path.join(HOME, ".aider.conf.yml")) || commandExists("aider") },

34 { name: "CodeGPT", path: path.join(HOME, ".codegpt", "config.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".codegpt")) },

35 { name: "GitHub Copilot CLI", path: path.join(HOME, ".config", "github-copilot", "config.json"), format: "mcpServers", detect: () => commandExists("gh") },

36 { name: "Warp Terminal", path: path.join(HOME, ".config", "warp-terminal", "config.yaml"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".config", "warp-terminal")) || commandExists("warp") },

37 { name: "WezTerm", path: path.join(HOME, ".wezterm.lua"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".wezterm.lua")) || commandExists("wezterm") },

38 { name: "Kitty Terminal", path: path.join(HOME, ".config", "kitty", "kitty.conf"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".config", "kitty")) || commandExists("kitty") },

39 { name: "Alacritty", path: path.join(HOME, ".config", "alacritty", "alacritty.toml"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".config", "alacritty")) || commandExists("alacritty") },

40 { name: "Hyper Terminal", path: path.join(HOME, ".hyper.js"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".hyper.js")) },

41 { name: "Tabby Terminal", path: path.join(HOME, ".config", "tabby", "config.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".config", "tabby")) },

42 { name: "Neovim", path: path.join(HOME, ".config", "nvim", "init.lua"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".config", "nvim")) || commandExists("nvim") },

43 { name: "Emacs", path: path.join(HOME, ".emacs.d", "init.el"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".emacs.d")) || commandExists("emacs") },

Lines 129-169javascript

129 const customPath = await question(rl, " Enter config file path: ");

130 rl.close();

131 const trimmedPath = customPath.trim();

132 if (trimmedPath) {

133 try {

134 const config = readJson(trimmedPath);

135 const newConfig = addToConfig(config, "mcpServers");

136 writeJson(trimmedPath, newConfig);

137 log(` ✅ Manual: ${trimmedPath}`);

138 log("");

139 return;

140 } catch (e) {

141 log(` ❌ Failed to write to ${trimmedPath}: ${e.message}`);

142 }

143 }

144 } else {

145 const indices = trimmed.split(",").map(s => parseInt(s.trim()) - 1);

146 selected = indices.filter(i => i >= 0 && i < detected.length).map(i => detected[i]);

147 }

148 } else {

149 selected = detected;

150 log(" Non-interactive mode: configuring all detected agents.");

151 }

152

153 if (selected.length === 0) {

154 log(" No agents selected. Skipping.");

155 log("");

156 log(" 💡 Run 'agent-nervous-system-mcp-setup' for interactive setup.");

High

Ai Review Evidence

In non-interactive mode, the installer selects every detected agent without asking the user.

scripts/postinstall.jsView on unpkg · L149

157 log("");

158 return;

159 }

160

161 log("");

162 log(" Configuring selected agents...");

163 log("");

164

165 let configured = 0;

166 for (const agent of selected) {

167 try {

168 const config = readJson(agent.path);

169 const newConfig = addToConfig(config, agent.format);

•matchType = previous_version_dangerous_delta matchedPackage = agent-nervous-system-mcp@1.1.0 matchedIdentity = npm:[redacted]:1.1.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

14"postinstall": "node scripts/postinstall.js" }, "keywords": ["mcp", "shared-context", "agent-memory", "ai", "common-context"], "author

High

Suspicious Lifecycle Evidence

package.json runs scripts/postinstall.js automatically during installation.

package.jsonView on unpkg · L14

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

23const AGENTS = [ L24: { name: "Claude Code", path: path.join(HOME, ".claude.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".claude.json")) || commandExists("claude") }, L25: { name: "Claude Desktop (macOS)", path: path.join(HOME, "Library", "Application Support", "Claude", "claude_desktop_config.json"), format: "mcpServers", detect: () => process.platf... L26: { name: "Claude Desktop (Linux)", path: path.join(HOME, ".config", "Claude", "claude_desktop_config.json"), format: "mcpServers", detect: () => process.platform === "linux" && fs.e... L27: { name: "Cursor", path: path.join(HOME, ".cursor", "mcp.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".cursor")) || commandExists("cursor") }, L28: { name: "OpenCode", path: path.join(HO

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

149selected = detected; log(" Non-interactive mode: configuring all detected agents."); } if (selected.length === 0) { log(" No agents selected. Skipping."); log(""); log(" 💡 Run 'agent-

High

Ai Review Evidence

In non-interactive mode, the installer selects every detected agent without asking the user.

scripts/postinstall.jsView on unpkg · L149

23const AGENTS = [ { name: "Claude Code", path: path.join(HOME, ".claude.json"), format: "mcpServers", detect: () => fs.existsSync(path.join(HOME, ".claude.json")) || commandExists("claude") }, { name: "Claude Desktop (macOS)",

High

Ai Review Evidence

The installer detects agent configuration files across the user's home directory.

scripts/postinstall.jsView on unpkg · L23

Findings

1 Critical5 High2 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltascripts/postinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencescripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to agent-nervous-system-mcp@2.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing agent-nervous-system-mcp@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-25 05:15:00.044Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

7 known versions

2.0.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 25, 2026, 5:10 AM 1.5.0MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 25, 2026, 4:55 AM 1.3.0MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 25, 2026, 4:50 AM 1.1.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 25, 2026, 4:41 AM 1.0.4MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 24, 2026, 6:20 PM 1.0.1MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 24, 2026, 6:10 PM 1.0.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 24, 2026, 6:03 PM

98%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

Version2.0.0

PublishedOct 25, 2026

LicenseMIT

Dependencies2

Integrityverified

Package size9.73 KB

Files5

Keywordsmcpshared-contextagent-memoryaicommon-context

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → ./dist/index.d.tsbin → agent-nervous-system-mcp, agent-nervous-system-mcp-setup

Runtimenode >=18.0.0

Artifact39.7 KB · 5 files2 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessFilesystemShellHighEntropyStringsManifest: clean

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Source & flagged code

Related packages

Other AI-agent control-surface risk packages