registry / clipatra-mcp / 0.10.6

clipatra-mcp@0.10.6

Drive Clipatra from Claude, ChatGPT, or any MCP client — manage performance-based creator campaigns in plain English.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `clipatra-mcp start`/`login`, completes browser approval, or runs `clipatra-mcp connect`.

Impact

Persistent AI-agent extension setup with a Clipatra credential and future code updates resolved through `@latest`.

Mechanism

User-invoked MCP client configuration and credential persistence.

Rationale

No concrete malware, install-time execution, exfiltration beyond the advertised Clipatra API, or destructive behavior was found. Per policy, the explicit persistent AI-agent config mutation merits a warning rather than a block.

Evidence

package.jsondist/login.jsdist/connect.jsdist/clients.jsdist/credentials.jsdist/api.js~/.clipatra/credentials.json~/.claude.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json.vscode/mcp.json

Network endpoints1

www.clipatra.com/api/v1

clipatra-mcp@0.10.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code