registry / AI-agent control-surface risk / brokre
brokre
MCP launcher for brokre — local credential broker for Cursor, Claude Code, Kimi Code, Trae, OpenClaw, Hermes Agent, ChatClaw, and other MCP clients
This report shows the evidence for brokre@0.2.32. 2 of 4 known versions are blocked or flagged. The newest version, 0.2.36, is flagged. See all versions.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package performs unconsented install-time writes to global AI-client MCP configuration and registers a command that resolves brokre@latest. This is a concrete AI-agent control-surface hijack under the install-control policy.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package with lifecycle scripts enabled.
Impact
The affected client may launch a later package release as an MCP server.
Mechanism
The hook runs setup-mcp.js, which writes brokre entries to detected MCP configuration locations; the entry invokes brokre@latest through npx.
Policy narrative
During npm installation, postinstall.js invokes setup-mcp.js. That script detects MCP clients and writes a brokre server entry to their global configuration without asking first. The entry uses npx to run brokre@latest, so a later client launch can retrieve and run a changing release.
AI rationale
The package performs unconsented install-time writes to global AI-client MCP configuration and registers a command that resolves brokre@latest. This is a concrete AI-agent control-surface hijack under the install-control policy.
Evidence
package.jsonpostinstall.jssetup-mcp.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.
Evidence for policy risk
- The npm postinstall hook runs postinstall.js automatically.
- The hook invokes setup-mcp.js, which writes configuration for detected MCP clients.
- The setup adds brokre to global MCP configuration without a consent prompt.
- The registered command runs brokre@latest through npx, enabling later retrieval of a changing release.
- The setup detects Cursor and other client configuration locations.
Evidence against
- The setup skips clients it does not detect and preserves existing entries unless forced.
- The package provides environment-variable opt-outs for its binary download and MCP setup.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg4scripts.postinstall = node postinstall.js
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L15:
L16: const { spawnSync } = require('child_process');
L17: const path = require('path');
...
L32: `brokre: postinstall binary download skipped (${err.message})\n` +
L33: ' First `brokre` / MCP start will retry. Manual: ' +
L34: 'https://raw.githubusercontent.com/Furowu/brokre/main/install.sh\n'
L35: );
...
L40: const setup = path.join(__dirname, 'setup-mcp.js');
L41: const res = spawnSync(process.execPath, [setup], {
L42: stdio: 'inherit',
L4: *
L5: * Spawns `brokre mcp` (stdio). Uses brokre on PATH, or downloads a prebuilt
L6: * release from GitHub into ~/.brokre/bin/ on first run.
...
L9:
L1
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4•scripts.postinstall = node postinstall.js
Medium
Findings
4 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighUnverified Remote Native Payload Installpackage.json
HighSandbox Evasion Gated Capabilitypostinstall.js
HighTrigger Reachable Persistenceindex.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceindex.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to brokre@0.2.32.
The versions list below shows the verdict for each recorded version.
- Avoid installing brokre@0.2.32. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
4 known versions0.2.36latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 24, 2026, 4:30 AM0.2.32shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 19, 2026, 1:41 AM0.2.26Scan Failed—AllowUnder ReviewSep 18, 2026, 2:29 PM0.2.25MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 10:53 AM