registry / agenthub-multiagent-mcp / 1.56.0
agenthub-multiagent-mcp@1.56.0
MCP server for AgentHub multi-agent communication
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource shows no concrete malicious install chain, credential theft, remote payload execution, or stealth persistence. However, default-on runtime modification of a foreign Claude Code hook surface is a real agent-extension lifecycle risk.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run the MCP server or explicitly run agenthub-setup.
Impact
Subsequent Claude sessions execute package hook CLIs; consented session capture can transmit tool/session events to AgentHub.
Mechanism
Claude hook registration and opt-in worker persistence
AI rationale
Source shows no concrete malicious install chain, credential theft, remote payload execution, or stealth persistence. However, default-on runtime modification of a foreign Claude Code hook surface is a real agent-extension lifecycle risk.
Evidence
package.jsondist/index.jsdist/activityHookInstall.jsdist/inboxHookInstall.jsdist/captureHookInstall.jsdist/session-capture.shdist/setup.js~/.claude/settings.json~/.claude/agenthub-capture.json~/.agenthub/worker.json~/Library/LaunchAgents/com.agenthub.worker.plist~/.config/systemd/user/agenthub-worker.service
Network endpoints2
agenthub.contetial.comagenthub.contetial.com/session-capture/consent
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js installs Claude hooks on MCP startup.
- dist/activityHookInstall.js writes ~/.claude/settings.json unless disabled.
- dist/inboxHookInstall.js adds a SessionStart command hook by default.
- dist/setup.js can create login startup services after interactive confirmation.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Hook commands reference package-local JS files, not downloaded code.
- dist/captureHookInstall.js requires server-confirmed consent and removes capture on failure/revocation.
- dist/session-capture.sh sends only to configured AgentHub endpoint and redacts secret-like values.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggednative/agenthub-memvid/index.jsView file
19try {
L20: const lddPath = require('child_process').execSync('which ldd').toString().trim()
L21: return readFileSync(lddPath, 'utf8').includes('musl')
High
Child Process
Package source references child process execution.
native/agenthub-memvid/index.jsView on unpkg · L19dist/commands/setup-shell.jsView file
25Trigger-reachable persistence chain: manifest.bin -> dist/setup.js -> dist/commands/setup-shell.js
L25: export function detectShell() {
L26: const shellPath = process.env.SHELL;
L27: if (!shellPath)
...
L35: export function rcFilePath(shell) {
L36: const home = os.homedir();
L37: return path.join(home, shell === "bash" ? ".bashrc" : ".zshrc");
L38: }
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/commands/setup-shell.jsView on unpkg · L25Findings
5 High6 Medium4 Low
HighChild Processnative/agenthub-memvid/index.js
HighShell
HighSame File Env Network Executiondist/daemon.js#virtual:normalized:round1
HighTrigger Reachable Persistencedist/commands/setup-shell.js
HighPrevious Version Dangerous Deltadist/daemon.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/commands/setup-shell.js
MediumShips Native Binarynative/agenthub-memvid/agenthub-memvid.win32-x64-msvc.node
MediumShips Build Helperdist/run-claude.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to agenthub-multiagent-mcp@1.56.0.
See all versions of agenthub-multiagent-mcp for other recorded verdicts.
- Review the evidence and your use of agenthub-multiagent-mcp@1.56.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.