registry / agenthub-multiagent-mcp / 1.58.0
agenthub-multiagent-mcp@1.58.0
MCP server for AgentHub multi-agent communication
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a broad default runtime integration with Claude Code and networked agent coordination, including injected instructions and bundled operational skills. The inspected source does not establish malware or an install-time attack chain, so a warning is proportionate.
Static reason
No blocking static signals were detected.
Trigger
User starts/configures the AgentHub MCP server; daemon/setup persistence requires explicit CLI use.
Impact
Changes subsequent Claude session behavior and makes package-supplied skills available; no install-time compromise was found.
Mechanism
Runtime Claude settings and skill installation plus AgentHub network coordination
AI rationale
The package has a broad default runtime integration with Claude Code and networked agent coordination, including injected instructions and bundled operational skills. The inspected source does not establish malware or an install-time attack chain, so a warning is proportionate.
Evidence
package.jsondist/index.jsdist/skillInstaller.jsdist/activityHookInstall.jsdist/inboxHookInstall.jsdist/inboxHookCli.jsdist/captureHookInstall.jsdist/commands/setup-shell.jsdist/daemon.js~/.claude/settings.json~/.claude/commands/start-session.md~/.claude/commands/close-session.md~/.claude/skills/
Network endpoints1
agenthub.contetial.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js auto-installs skills and two Claude hooks on every MCP startup unless opt-out.
- dist/skillInstaller.js writes bundled commands and skills to ~/.claude, including destructive deployment runbooks.
- dist/activityHookInstall.js and dist/inboxHookInstall.js modify ~/.claude/settings.json; both default enabled.
- dist/inboxHookCli.js injects an AgentHub-directed system reminder at Claude session start.
- dist/daemon.js connects to the configured AgentHub API/WebSocket and spawns Claude workers.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Shell persistence in dist/commands/setup-shell.js is only via explicit agenthub-setup command.
- Capture-hook installation checks server consent and removes its grant/hook when absent.
- No inspected source showed credential exfiltration, remote payload loading, eval, or destructive behavior without a user-invoked runtime.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
7 flaggednative/agenthub-memvid/index.jsView file
19try {
L20: const lddPath = require('child_process').execSync('which ldd').toString().trim()
L21: return readFileSync(lddPath, 'utf8').includes('musl')
High
Child Process
Package source references child process execution.
native/agenthub-memvid/index.jsView on unpkg · L19dist/channelSetupCli.jsView file
30if (process.platform === "win32") {
L31: const out = execFileSync("powershell", [
L32: "-NoProfile",
High
dist/commands/setup-shell.jsView file
Findings
4 High6 Medium4 Low
HighChild Processnative/agenthub-memvid/index.js
HighShelldist/channelSetupCli.js
HighSame File Env Network Executiondist/daemon.js#virtual:normalized:round1
HighTrigger Reachable Persistencedist/commands/setup-shell.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/commands/setup-shell.js
MediumShips Native Binarynative/agenthub-memvid/agenthub-memvid.win32-x64-msvc.node
MediumShips Build Helperdist/run-claude.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to agenthub-multiagent-mcp@1.58.0.
See all versions of agenthub-multiagent-mcp for other recorded verdicts.
- Review the evidence and your use of agenthub-multiagent-mcp@1.58.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.