registry / claude-cup / 0.9.9

claude-cup@0.9.9

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Running `claude-cup` once persists an MCP server and SessionStart/PreToolUse/PostToolUse hooks in Claude Code configuration. Hook-triggered background analysis scans developer environment data and can invoke Claude with automatic permissions.

Static reason

No blocking static signals were detected.

Trigger

User runs the `claude-cup` or `claude-jar` CLI.

Impact

Persistent Claude/Cursor integration, broad local metadata/credential discovery, and automated Claude CLI audit execution.

Mechanism

first-run agent-hook registration plus default-on environment and credential capability profiling

Rationale

Source establishes unconsented persistent AI-agent integration and broad local discovery after explicit CLI execution. Because no install-time lifecycle hook performs the mutation and raw credential exfiltration was not confirmed, warn rather than block.

Evidence

package.jsonsrc/cli.jsmcp-server/src/registration.jsmcp-server/src/calibrator.jsmcp-server/src/meter-fill.jsmcp-server/src/claude-audit.js~/.claude/settings.json~/.claude/CLAUDE.md~/.claude-jar/mcp-server.mjs~/.claude-jar/registration.json~/.claude-jar/cup-config.json~/.cursor/mcp.json

Network endpoints2

api.claude-cup.com/v1/configapi.anthropic.com/api/oauth/usage

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/cli.js` auto-registers MCP and broad Claude hooks on first CLI run.
`mcp-server/src/registration.js` rewrites `~/.claude/settings.json`, creates `~/.claude-jar/mcp-server.mjs`, and can register Cursor.
`mcp-server/src/calibrator.js` enables full environment analysis by default and stores credential-related findings.
`mcp-server/src/meter-fill.js` scans home/workspace, browser-session metadata, platform services, and development key assets.
`mcp-server/src/claude-audit.js` launches `claude -p --permission-mode auto` for an audit.
`mcp-server/src/uploader.js` fetches remote configuration from the package service.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
`scripts/postinstall-ping.mjs` is present but not referenced by the package lifecycle scripts.
Observed package-service requests carry summarized metadata/config traffic; no direct upload of raw credential values to that service was found.
The visible CLI path is user-invoked and registration records/backups are created.

Behavioral surface

Source & flagged code

2 flagged

mcp-server/dist/mcp-server.mjsView file

Lines 1-19javascript

1#!/usr/bin/env node

2// claude-cup MCP launcher (copied to ~/.claude-jar/mcp-server.mjs on registration)

3// This is the entry registered in ~/.claude/settings.json (and Cursor equivalents).

4// It supports both long-lived stdio MCP server mode and short-lived --hook mode.

5// The source path is baked in at build time so the launcher works from any directory.

7import { pathToFileURL } from 'node:url';

8const SRC = "C:\\Users\\itaib\\nice claude iedeas\\Claude-\\claude-jar\\mcp-server\\src";

9const toURL = f => pathToFileURL(f).href;

10const isHook = process.argv.includes('--hook');

12if (isHook) {

13 const { runHookIngest } = await import(toURL(SRC + '/hook-ingest.js'));

14 await runHookIngest(process.argv);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server/dist/mcp-server.mjsView on unpkg · L12

15} else {

16 const { startMcpServer } = await import(toURL(SRC + '/index.js'));

17 await startMcpServer();

18}

src/cli.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2process.title = 'claude-cup';

3// Force the terminal tab/window title to "claude-cup" via OSC sequences.

4// We emit BOTH OSC 0 (icon name + window title) and OSC 2 (window title only)

5// with both BEL and ST terminators so Windows Terminal, ConPTY, VS Code, and

6// Cursor all pick it up. This overrides any folder-name or AWS-profile prefix

7// inherited from the parent shell.

8if (process.stdout && process.stdout.isTTY) {

Source & flagged code

2 flagged · loading source

mcp-server/dist/mcp-server.mjsView file

12if (isHook) { L13: const { runHookIngest } = await import(toURL(SRC + '/hook-ingest.js')); L14: await runHookIngest(process.argv);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server/dist/mcp-server.mjsView on unpkg · L12

src/cli.jsView file

7Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L7: // inherited from the parent shell. L8: if (process.stdout && process.stdout.isTTY) { L9: try { L10: process.stdout.write('\x1b]0;claude-cup\x07'); L11: process.stdout.write('\x1b]2;claude-cup\x07'); ... L25: import { fileURLToPath } from 'node:url'; L26: import { spawn } from 'node:child_process'; L27: import { Aggregator } from './aggregator.js'; ... L123: try { L124: if (process.platform === 'win32') { L125: spawn('cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' }).unref(); ... L194:

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

src/cli.jsView on unpkg · L7

Findings

1 High4 Medium5 Low

HighEntrypoint Build Divergencesrc/cli.js

MediumDynamic Requiremcp-server/dist/mcp-server.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings