Loading npm security reports…
Local-first BrainHub MCP server for personal Google Drive sessions
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically alters detected AI-client integrations. It registers an MCP server and installs skills in user-level client directories.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe npm postinstall hook automatically launches an integration installer in published installs.
package.jsonView on unpkg · L50Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/clients/registry.jsView on unpkg · L1This report applies to brainhub-mcp@0.5.0.
See version security history for other recorded verdicts.
Evidence last updated: .
The npm postinstall hook automatically launches an integration installer in published installs.
package.jsonView on unpkg · L50Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L51Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L51Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/clients/registry.jsView on unpkg · L1