registry / claude-token-tracker-mcp / 0.0.1-security

claude-token-tracker-mcp@0.0.1-security

security holding package

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed attack surface is present in this placeholder package. The README describes a prior removal but no malicious source remains.

Static reason

No blocking static signals were detected.

Trigger

None.

Impact

No package-executed behavior established.

Mechanism

Metadata-only holding package.

Rationale

Direct inspection shows a two-file holding package with no executable code or install/runtime entrypoint. The README's historical claim is not evidence of behavior in this published version.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` contains metadata only; no scripts, entrypoints, dependencies, or lifecycle hooks.
Package contains only `package.json` and `README.md`; no executable source, binaries, or hidden package files.
No credential access, filesystem mutation, subprocess use, dynamic execution, or network code is present.

claude-token-tracker-mcp@0.0.1-security

AI Security Review

Decision evidence

Source & flagged code

Findings