registry / agentic-cortex / 6.5.0

agentic-cortex@6.5.0

⚠ Under review

Persistent self-improving agent memory with tree-of-thoughts reasoning: MCTS/beam search, PRM step verification, self-consistency voting, s1 budget forcing, REPL program-aided reasoning, reflexion self-correction, 67 MCP tools

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 1010 KB of source, external domains: 127.0.0.1, addyosmani.com, agenticai-flow.com, arxiv.org, developersdigest.substack.com, docs.cursor.com, docs.github.com, every.to, github.com, support.claude.com, www.anthropic.com, www.confluent.io

Source & flagged code

11 flagged

package.jsonView file

Lines 12-43json

12 "semantic-memory"

13 ],

14 "license": "MIT",

15 "author": "zallauddin",

16 "bin": {

17 "agentic-cortex": "cli.js",

18 "agentic-cortex-mcp": "src/mcp/server.js"

19 },

20 "main": "cli.js",

21 "dependencies": {

22 "better-sqlite3": "^12.11.1"

23 },

24 "optionalDependencies": {

25 "@xenova/transformers": "^2.17.2"

26 },

27 "engines": {

28 "node": ">=18"

29 },

30 "scripts": {

31 "test": "node --test tests/*.test.js",

32 "postinstall": "node scripts/auto-setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "dashboard": "node cli.js serve"

34 },

35 "files": [

36 "cli.js",

37 "src/",

38 "scripts/",

39 "templates/",

40 "README.md"

41 ]

42}

scripts/import-community-knowledge.jsView file

Lines 730-770javascript

730 // ═══════════════════════════════════════════════════════════════════

731

732 obs('decision', 'AI-Generated Code Quality Gates: Mandatory Verification Steps', `

733# Code Quality Gates for AI-Generated Code

734

735Before accepting ANY AI-generated code change, apply these gates:

736

737## Gate 1: Syntax & Compilation

738

scripts/demo-nonllm-agent.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * demo-nonllm-agent.js — Non-LLM Agent Demo

4 *

5 * Demonstrates agentic-cortex v5.0.0's brain orchestration layer executing

6 * a complete bug-fix-cycle using ONLY deterministic state machines, rules,

7 * and workflows — zero LLM calls.

8 *

9 * Architecture:

10 * FSM Engine: debug-workflow (reproducing → diagnosing → fixing → verifying → closed)

scripts/create-discovery-files.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * create-discovery-files.js — Shared module for creating multi-agent discovery files.

4 *

5 * Creates files that various AI coding agents automatically read at session start:

6 * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery)

7 * - .claude/CLAUDE.md (Claude Code)

8 * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true)

9 * - .opencode/agentic-cortex.md (OpenCode / Codebuff)

10 *

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

src/sync/git-sync.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = src/sync/git-sync.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sync/git-sync.jsView on unpkg

scripts/auto-setup.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/auto-setup.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/auto-setup.jsView on unpkg

scripts/inject-memory.mjsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/inject-memory.mjs matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inject-memory.mjsView on unpkg

Source & flagged code

11 flagged · loading source

agentic-cortex@6.5.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code