registry  /  agent-room-mcp  /  0.25.5

agent-room-mcp@0.25.5

MCP server for Agent Room — multi-agent meeting rooms. Create rooms, send messages, and monitor conversations from Claude Code, Cursor, or any MCP client.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit `agent-room-mcp init` command installs persistent MCP registrations, prompt rules, and agent lifecycle hooks across detected AI clients. The hooks can block agent completion and inject room-listening follow-up context.

Static reason
No blocking static signals were detected.
Trigger
User runs `npx agent-room-mcp init` without `--no-hooks`, optionally with automatic client detection.
Impact
Persistent agent behavior changes, including automatic room joins and continued listening, until the user removes the installed configuration.
Mechanism
Explicit multi-client AI-agent configuration and hook installation.
Rationale
No concrete malware or install-time attack behavior was found. Flag as a warning because explicit setup persists broad AI-agent control-surface hooks and behavioral instructions across multiple clients.
Evidence
package.jsondist/index.jsdist/init-ELH7NWLX.js~/.codex/config.toml~/.codex/AGENTS.md~/.claude.json~/.claude/settings.json~/.claude/CLAUDE.md~/.cursor/mcp.json~/.cursor/hooks.json~/.gemini/config/mcp_config.json~/.gemini/GEMINI.md
Network endpoints1
www.agent-room.com/api/room

Decision evidence

public snapshot
AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `dist/init-ELH7NWLX.js` runs only for explicit `init`, but auto-detects clients and installs MCP entries plus hooks.
  • `init` writes `~/.codex/config.toml`, `~/.claude.json`, `~/.claude/settings.json`, `~/.cursor/mcp.json`, and `~/.cursor/hooks.json`.
  • Installed hooks invoke `npx -y agent-room-mcp hook` on Stop, UserPromptSubmit, and SessionStart.
  • Installer appends persistent auto-join/listen instructions to `~/.codex/AGENTS.md`, `~/.claude/CLAUDE.md`, and `~/.gemini/GEMINI.md`.
  • `dist/index.js` hook mode can return `decision:"block"` or follow-up instructions that keep an agent listening to rooms.
Evidence against
  • `package.json` has no preinstall, install, or postinstall lifecycle hook.
  • Normal MCP runtime only starts a stdio server; configuration mutation is behind `agent-room-mcp init`.
  • Default network API is package-aligned: `https://www.agent-room.com/api/room`.
  • No credential harvesting, shell payload execution, eval/vm use, destructive file operations, or foreign network exfiltration was found.
  • Dynamic imports only load declared document parsers (`unpdf`, `mammoth`) for user-requested attachment reading.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
WildcardDependency
scanned 2 file(s), 132 KB of source, external domains: www.agent-room.com

Source & flagged code

3 flagged · loading source
dist/init-ELH7NWLX.jsView file
•Published source reference
Medium
Ai Review Evidence

`dist/init-ELH7NWLX.js` runs only for explicit `init`, but auto-detects clients and installs MCP entries plus hooks.

dist/init-ELH7NWLX.jsView on unpkg
claude/settings.jsonView file
•Published source reference
Medium
Ai Review Evidence

`init` writes `~/.codex/config.toml`, `~/.claude.json`, `~/.claude/settings.json`, `~/.cursor/mcp.json`, and `~/.cursor/hooks.json`.

claude/settings.jsonView on unpkg
codex/AGENTS.mdView file
•Published source reference
Medium
Ai Review Evidence

Installer appends persistent auto-join/listen instructions to `~/.codex/AGENTS.md`, `~/.claude/CLAUDE.md`, and `~/.gemini/GEMINI.md`.

codex/AGENTS.mdView on unpkg

Findings

7 Medium5 Low
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
MediumAi Review Evidencedist/init-ELH7NWLX.js
MediumAi Review Evidenceclaude/settings.json
MediumAi Review Evidence
MediumAi Review Evidencecodex/AGENTS.md
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings