registry / AI-agent control-surface risk / cielara-enterprise

cielara-enterprise

Cielara Enterprise MCP connector — installs an MCP server for Claude, Codex, and Cursor that connects to the Cielara knowledge graph, agent memory, and world model, plus the code-graph sidecar, skills, and grep enrichment hooks.

This report shows the evidence for cielara-enterprise@0.1.41. 1 of 3 known versions is blocked or flagged. The newest version, 0.1.43, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source confirms an unconsented npm postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking install-control-surface policy independently of the telemetry concern.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install in an interactive terminal (or npm install with --yes).

Impact

Codex, Claude Code, and Cursor can automatically launch the package MCP server; collected device/usage metadata may be transmitted to the portal.

Mechanism

postinstall AI-agent MCP configuration injection and default telemetry collection

Policy narrative

On a normal interactive install, postinstall calls install() with the default target set, which writes Cielara MCP server entries into Codex, Claude Code, and Cursor user configuration and copies skills. Those entries execute `npx -y cielara-enterprise mcp` when the agent client starts. Separately, runtime telemetry buffers identifying device and usage fields and posts them to the configured portal, defaulting to cielaracode.com.

AI rationale

Source confirms an unconsented npm postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking install-control-surface policy independently of the telemetry concern.

Evidence

package.jsonscripts/postinstall.jslib/install.jslib/telemetry.jsskills/cielara-usage/SKILL.md~/.codex/config.toml~/.claude.json~/.cursor/mcp.json~/.codex/skills~/.claude/skills~/.cursor/skills~/.cielara/telemetry.ndjson

Network endpoints1

cielaracode.com/v1/telemetry

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
scripts/postinstall.js calls install() on interactive installs.
lib/install.js writes MCP entries to Codex, Claude Code, and Cursor configs by default.
Installed MCP command invokes `npx -y cielara-enterprise mcp`.
lib/telemetry.js sends device and usage fields to https://cielaracode.com/v1/telemetry by default.
skills/cielara-usage/SKILL.md instructs agents to flush telemetry with elevated permissions.

Evidence against

preinstall only guards conflicting global sibling installs.
postinstall skips its integration setup in CI.
Telemetry requires buffered events and authenticated credentials to transmit.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

8 flagged

package.jsonView file

Lines 26-53json

26 ],

27 "keywords": [

28 "cielara",

29 "cielara-enterprise",

30 "mcp",

31 "claude",

32 "codex",

33 "connector",

34 "knowledge-graph",

35 "ontology"

36 ],

37 "homepage": "https://causaldynamics.com",

38 "repository": {

39 "type": "git",

40 "url": "https://github.com/causaldynamics-research/cielara-code-connector.git"

41 },

42 "engines": {

43 "node": ">=18.0.0"

44 },

45 "scripts": {

46 "preinstall": "node scripts/preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "preuninstall": "node scripts/preuninstall.js",

49 "prepack": "find python -type d -name __pycache__ -prune -exec rm -rf {} + 2>/dev/null; find python -name '*.pyc' -delete 2>/dev/null; true"

50 },

51 "version": "0.1.41"

52}

bin/cielara-code.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4// Thin launcher that puts the packaged `cielara-code` sidecar binary on PATH.

5// The real binary lives at cielara/<platform>/cielara-code(.exe) — a path that

6// varies by OS/arch — so npm can't symlink it directly as a `bin`. This shim

7// resolves the right binary at runtime and execs it with full arg/stdio/exit

8// passthrough.

9//

10// Note: this is a DIRECT line to the sidecar. It bypasses the `cielara` CLI's

lib/telemetry.jsView file

Lines 1-26javascript

1'use strict';

3const crypto = require('crypto');

4const fs = require('fs');

5const

lib/install.jsView file

Lines 56-96javascript

56 if (error && error.code === 'ENOENT') {

57 return {};

58 }

59 throw error;

60 }

61 // Treat empty / whitespace-only files as missing. A previous editor crash

cielara/linux-arm64/leiden_helperView file

•path = cielara/linux-arm64/leiden_helper kind = native_binary sizeBytes = 2902104 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

cielara/linux-arm64/leiden_helperView on unpkg

python/memory_mcp/server.pyView file

•path = python/memory_mcp/server.py kind = build_helper sizeBytes = 37509 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/memory_mcp/server.pyView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cielara-code.jsView file

Findings

2 Critical1 High8 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationlib/telemetry.js

CriticalAi Agent Control Hijacklib/install.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/cielara-code.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarycielara/linux-arm64/leiden_helper

MediumShips Build Helperpython/memory_mcp/server.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to cielara-enterprise@0.1.41.

The versions list below shows the verdict for each recorded version.

Avoid installing cielara-enterprise@0.1.41. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-03 20:17:12.302Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.1.43latestSuspicious—WarnPublishedJul 2, 2026, 9:19 PM 0.1.42Suspicious—WarnPublishedJul 1, 2026, 7:27 AM 0.1.41shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJun 30, 2026, 5:44 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code