Loading npm security reports…

codesift-mcp@0.14.0: AI-agent control-surface risk | LPM Firewall

registry / codesift-mcp / 0.14.0

codesift-mcp@0.14.0

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code silently modifies broad third-party AI-agent configuration and hook surfaces. It registers CodeSift as an MCP server and enables CodeSift command hooks without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation.

Impact

AI clients can invoke package-controlled MCP tooling and commands; subsequent server use also sends default anonymous telemetry.

Mechanism

Automatic multi-platform AI-agent configuration and hook injection.

Policy narrative

Installing the package invokes `codesift setup all` automatically. That path configures CodeSift in Codex, Claude, Cursor, Gemini, and Antigravity, enables approval-required CodeSift MCP configuration for Codex, and installs Claude/Gemini hooks that run `codesift` commands around agent actions. These are foreign, broad AI-agent control-surface mutations performed without an explicit user setup action.

Rationale

Direct source inspection confirms an unconsented postinstall path that mutates multiple third-party AI-agent configuration and hook files. This meets the blocking boundary for broad foreign AI-agent control-surface mutation.

Evidence

package.jsondist/cli/commands.jsdist/cli/setup.jsdist/cli/setup/mcp.jsdist/cli/setup/codex.jsdist/cli/setup/claude.jsdist/cli/setup/gemini.jsdist/storage/telemetry/uploader.js

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/cli.js setup all 2>/dev/null && echo ' ✨ CodeSift MCP installed and configured for all platforms. ⚠️ Restart your AI client (Cmd+Q for Claude Code) to load new MCP...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/cli.js setup all 2>/dev/null && echo ' ✨ CodeSift MCP installed and configured for all platforms. ⚠️ Restart your AI client (Cmd+Q for Claude Code) to load new MCP...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tools/patterns/adapters/php.jsView file

11regex: /\beval\s*\(/, L12: description: "eval() usage — code injection risk (PHP)", L13: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/patterns/adapters/php.jsView on unpkg · L11

dist/tools/pg-introspection.jsView file

13const pgSpecifier = "pg"; L14: const mod = (await import(/* @vite-ignore */ pgSpecifier)); L15: // Handle both ESM default-export and CJS named-export shapes.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/pg-introspection.jsView on unpkg · L13

dist/tools/index-tools/snapshots.jsView file

118const raw = await readFile(versionsPath, "utf-8"); L119: storedVersions = JSON.parse(raw); L120: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/index-tools/snapshots.jsView on unpkg · L118

dist/cli/service.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codesift-mcp@0.9.5 matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.9.5 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/service.jsView on unpkg

6import { fileURLToPath } from "node:url"; L7: import { execFileSync } from "node:child_process"; L8: /** ... L66: export function buildServicePlan(opts) { L67: const home = opts.home ?? homedir(); L68: const os = opts.os ?? platform(); ... L83: unitPath, L84: stdoutLog: join(logDir, "daemon.out.log"), L85: stderrLog: join(logDir, "daemon.err.log"), ... L150: Description=CodeSift shared MCP daemon L151: Documentation=https://github.com/greglas75/codesift L152: After=network.target

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/service.jsView on unpkg · L6

dist/tools/agent-config-tools.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L58: } L59: const configPath = options?.config_path ?? join(index.root, "CLAUDE.md"); L60: let content; Write operation from dist/cli/commands.js: L4: import { join } from "node:path"; L5: import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs"; L6: import { execFileSync } from "node:child_process"; ... L64: } L65: mkdirSync(dataDir, { recursive: true }); L66: writeFileSync(pidPath, String(process.pid)); L67: const { startHttpServer } = await import("../server.js"); ... L75: const handle = await startHttpServer(httpOpts); L76: writeFileSync(portPath, String(handle.port)); L77: const release = () => { Foreign user/project scope from dist/config.js: L1: import { homedir, totalmem } from "node:os"; L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/tools/agent-config-tools.jsView on unpkg · L1

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 11-51json

11 },

12 "main": "./dist/server.js",

13 "files": [

14 "dist",

15 "rules",

16 "hooks",

17 "src/parser/languages",

18 "README.md",

19 "LICENSE"

20 ],

21 "scripts": {

22 "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc && cp -r src/parser/languages dist/parser/ && chmod +x dist/cli.js dist/server.js && node scripts/restart-daemon-after-build.mjs",

23 "dev": "tsx src/server.ts",

24 "start": "node dist/server.js",

25 "test": "vitest run",

26 "test:watch": "vitest",

27 "test:coverage": "vitest run --coverage",

28 "lint": "biome lint . && tsc --noEmit",

29 "download-wasm": "tsx scripts/download-wasm.ts",

30 "prepublishOnly": "npm run build && npm test",

31 "postinstall": "node ./dist/cli.js setup all 2>/dev/null && echo '\n ✨ CodeSift MCP installed and configured for all platforms.\n ⚠️ Restart your AI client (Cmd+Q for Claude Code) to load new MCP server.\n' || echo '\n ✨ CodeSift MCP installed. Run: codesift setup all\n'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "lint:fix": "biome lint --write . && tsc --noEmit"

33 },

34 "dependencies": {

35 "@manypkg/get-packages": "^3.1.0",

36 "@modelcontextprotocol/core": "^2.0.0",

37 "@modelcontextprotocol/node": "^2.0.0",

38 "@modelcontextprotocol/sdk": "^1.0.0",

39 "@modelcontextprotocol/server": "^2.0.0",

40 "@mrleebo/prisma-ast": "^0.15.0",

41 "@parcel/watcher": "^2.5.6",

42 "@sanity-labs/secret-scan": "^1.1.0",

43 "get-tsconfig": "^4.14.0",

44 "graphology": "^0.26.0",

45 "graphology-metrics": "^2.4.0",

46 "ignore": "^6.0.0",

47 "picomatch": "^4.0.4",

48 "web-tree-sitter": "^0.26.11",

49 "zod": "^4.3.6"

50 },

51 "optionalDependencies": {

dist/tools/patterns/adapters/php.jsView file

Lines 1-31javascript

1export const PHP_PATTERNS = {

2 "sql-injection-php": {

3 regex: /\$_(?:GET|POST|REQUEST)\[[^\]]+\][\s\S]{0,200}?(?:->query\(

dist/tools/pg-introspection.jsView file

Lines 1-33javascript

1/**

2 * PostgreSQL introspection tools.

3 * `pg` is an optional dependency — all imports are dynamic so the module

4 * loads cleanly even when `pg` is not installed.

5 */

6import { buildRelationships, buildTables } from "./pg-introspect-formatters.js";

7export async function loadPgClient

dist/tools/index-tools/snapshots.jsView file

Lines 98-138javascript

98 });

99 }

100 return result;

101}

102export const ASTRO_LOCK_FILENAME = "astro-reindex.lock";

103export const

dist/cli/service.jsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, existsSync, unlinkSync } from "node:fs";

2import { homedir, platform } from "node:os";

3import { join, dirname } from "node:path";

4import { isLoopbackHost } from "../utils/loopback.js";

dist/tools/agent-config-tools.jsView file

Lines 1-21javascript

1import { readFile } from "node:fs/promises";

2import { join } from "node:path";

3import { getCodeIndex } from "./index-tools.js";

4// ---------------------------------------------------------------------------

5// Regex extractors

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg