registry / agent-nervous-system-mcp / 1.0.0
agent-nervous-system-mcp@1.0.0
Shared context MCP for AI agents - append-only, zero config, auto-detect
AI Security Review
scanned 14h ago · by lpm-firewall-aiThe unprompted install-time changes to existing agent configurations create a real lifecycle risk. The inspected runtime’s local storage and standard input/output behavior do not establish credential theft or remote data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package runs its postinstall hook.
Impact
Future agent sessions may load the added server and receive its mandatory context-saving instructions.
Mechanism
The hook adds an MCP entry to agent configurations when the configuration or its parent directory exists, then writes the updated file.
AI rationale
The unprompted install-time changes to existing agent configurations create a real lifecycle risk. The inspected runtime’s local storage and standard input/output behavior do not establish credential theft or remote data exfiltration.
Evidence
package.jsonscripts/postinstall.jsdist/index.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install lifecycle automatically runs the package’s postinstall script.
- The hook adds the package’s MCP entry to existing per-user agent configuration locations and writes the updated configuration.
- The MCP server gives connected agents mandatory instructions to load and frequently save shared context.
- The runtime stores shared context in a file under the user’s home directory and connects over standard input and output; no outbound transfer was identified in the inspected runtime.
Evidence against
- The setup registers this package’s own shared-context MCP server, and the inspected runtime uses local storage and standard input/output rather than an identified remote endpoint.
Behavioral surface
Filesystem
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg9"scripts": {
"build": "tsc",
"start": "node dist/index.js",
"prepublishOnly": "npm run build",
"postinstall": "node scripts/postinstall.js"
},
"keywords": ["mcp", "shar
Medium
Suspicious Lifecycle Evidence
The install lifecycle automatically runs the package’s postinstall script.
package.jsonView on unpkg · L9scripts/postinstall.jsView file
Findings
1 Critical1 High6 Medium4 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencescripts/postinstall.js
MediumAi Review Evidencescripts/postinstall.js
MediumAi Review Evidencescripts/postinstall.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to agent-nervous-system-mcp@1.0.0.
See all versions of agent-nervous-system-mcp for other recorded verdicts.
- Review the evidence and your use of agent-nervous-system-mcp@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.