registry / agenthub-multiagent-mcp / 1.61.0
agenthub-multiagent-mcp@1.61.0
MCP server for AgentHub multi-agent communication
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource establishes automatic first-party Claude extension setup and remote task execution, so warning is warranted. The package lacks install-time lifecycle execution, and capture behavior is consent-gated and fail-closed.
Static reason
No blocking static signals were detected.
Trigger
Running the MCP entrypoint; separately, running agenthub-worker with configured credentials.
Impact
Persists package-controlled commands in ~/.claude and can transmit dispatched-session output to the configured AgentHub server.
Mechanism
Auto-installed Claude hooks/skills and server-dispatched headless Claude execution.
AI rationale
Source establishes automatic first-party Claude extension setup and remote task execution, so warning is warranted. The package lacks install-time lifecycle execution, and capture behavior is consent-gated and fail-closed.
Evidence
package.jsondist/index.jsdist/activityHookInstall.jsdist/inboxHookInstall.jsdist/skillInstaller.jsdist/worker.jsdist/captureHookInstall.js~/.claude/settings.json~/.claude/commands/<bundled-skill>~/.claude/skills/<bundled-skill>/SKILL.md~/.agenthub/activity$TMPDIR/agenthub-worker-prompt-<timestamp>.txt
Network endpoints2
agenthub.contetial.comwss://agenthub.contetial.com/ws/workers/<worker-id>
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- MCP startup auto-installs bundled skills into ~/.claude unless opted out.
- Startup adds executable Claude Code PostToolUse and SessionStart hooks; activity is enabled by default.
- Worker accepts server dispatches, launches Claude in a supplied project directory, and posts output to its configured server.
Evidence against
- package.json has no npm preinstall/install/postinstall lifecycle hook.
- Capture-hook installation requires a server consent response and treats failure as not consented.
- Hook installers preserve existing hook arrays and avoid duplicate package-marked entries.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggednative/agenthub-memvid/index.jsView file
19try {
L20: const lddPath = require('child_process').execSync('which ldd').toString().trim()
L21: return readFileSync(lddPath, 'utf8').includes('musl')
High
Child Process
Package source references child process execution.
native/agenthub-memvid/index.jsView on unpkg · L19dist/channelSetupCli.jsView file
30if (process.platform === "win32") {
L31: const out = execFileSync("powershell", [
L32: "-NoProfile",
High
dist/commands/setup-shell.jsView file
Findings
7 High6 Medium4 Low
HighChild Processnative/agenthub-memvid/index.js
HighShelldist/channelSetupCli.js
HighSame File Env Network Executiondist/daemon.js#virtual:normalized:round1
HighEntrypoint Foreign Package Code Overwritedist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/worker.js
HighTrigger Reachable Persistencedist/commands/setup-shell.js
HighSemantic Analysis Limiteddist/tools/zohoAttachments.test.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/commands/setup-shell.js
MediumShips Native Binarynative/agenthub-memvid/agenthub-memvid.win32-x64-msvc.node
Medium
Affected versions and remediation
This report applies to agenthub-multiagent-mcp@1.61.0.
See all versions of agenthub-multiagent-mcp for other recorded verdicts.
- Review the evidence and your use of agenthub-multiagent-mcp@1.61.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.