registry / AI-agent control-surface risk / aidex-mcp
aidex-mcp
MCP Server for persistent code indexing. Gives AI assistants (Claude, Gemini, Copilot, Cursor) instant access to your codebase. 50x less context than grep.
This report shows the evidence for aidex-mcp@2.4.0. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 18d ago · by lpm-firewall-aiInspected source establishes an automatic postinstall chain that mutates foreign, user-wide AI-agent configurations and instructions without consent. This meets the explicit blocking policy regardless of the package-aligned local server or available opt-out.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall when the built entrypoint exists and neither AIDEX_NO_SETUP nor CI disables setup.
Impact
Future agent sessions inherit package-selected tool preferences and automatic indexing instructions across projects.
Mechanism
The lifecycle script invokes the setup command, which writes foreign client configurations and appends or replaces global agent instruction blocks.
Policy narrative
Installing the package launches its setup command automatically. Setup detects installed AI clients, registers AiDex in their user configurations, and writes global Claude and Gemini instruction files. Those instructions mandate package-preferred search behavior and automatic initialization. The opt-out environment variable does not provide affirmative consent for these default changes to foreign agent controls.
AI rationale
Inspected source establishes an automatic postinstall chain that mutates foreign, user-wide AI-agent configurations and instructions without consent. This meets the explicit blocking policy regardless of the package-aligned local server or available opt-out.
Evidence
package.jsonscripts/postinstall.mjsbuild/index.jsbuild/commands/setup.js.claude/CLAUDE.md.gemini/GEMINI.md.cursor/mcp.json.codeium/windsurf/mcp_config.json.gemini/settings.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json automatically runs scripts/postinstall.mjs after installation.
- The install script runs setup by default; AIDEX_NO_SETUP or CI can skip it, but no consent prompt is present.
- build/index.js dispatches setup directly to setupMcpClients.
- Setup appends or updates instructions in user-wide .claude/CLAUDE.md and .gemini/GEMINI.md files.
- Setup writes AiDex registrations into foreign AI client configurations, including Cursor, Windsurf, Gemini, Claude Desktop, and VS Code.
- The installed instructions require agents to prefer AiDex over ordinary code-search tools and automatically initialize its index.
Evidence against
- An environment variable can disable automatic setup.
- Registrations launch the package's own local entrypoint; the inspected attack chain does not establish credential theft.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbuild/embeddings/index.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/embeddings/index.js#virtual:normalized:round1View on unpkgFindings
6 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbuild/embeddings/index.js#virtual:normalized:round1
HighKnown Malware Source Similaritybuild/viewer/server.js
HighKnown Malware Source Similaritybuild/commands/setup.js
HighKnown Malware Source Similaritybuild/viewer/progress.js
HighKnown Malware Source Similarityscripts/postinstall.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to aidex-mcp@2.4.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing aidex-mcp@2.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.