registry / codesift-mcp / 0.21.0

codesift-mcp@0.21.0

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The automatic postinstall performs first-party agent integration setup and modifies agent configuration, which warrants a warning under the agent extension lifecycle policy. The reviewed runtime account-action candidates are indexing and cache operations, not automatic external account changes.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled.

Impact

Agent configuration can be changed during installation, enabling CodeSift integrations and related setup behavior in those clients.

Mechanism

The postinstall launches the CLI setup command for all platforms, which applies default agent setup options and writes package-owned integration configuration.

AI rationale

Evidence

package.jsonpostinstall.mjsdist/postinstall.jsdist/cli/commands-admin.jsdist/cli/setup.jsdist/cli/setup/codex.jsdist/cli/setup/rules.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs postinstall.mjs, which imports dist/postinstall.js when present; that script launches the CLI with setup all.
The setup command defaults hooks and rules on, and setup all processes the supported platforms. This installs the package’s own agent integrations automatically during npm installation.
Codex setup writes its MCP configuration under the user’s .codex directory. The inspected agent setup code configures the package’s own MCP server.
The runtime locations flagged for account actions resolve to file watching, indexing, index freshness, and cached search operations; they do not show automatic external account changes.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

22 flagged

package.jsonView file

Lines 12-52json

12 "main": "./dist/server.js",

13 "files": [

14 "dist",

15 "postinstall.mjs",

16 "rules",

17 "hooks",

18 "src/parser/languages",

19 "README.md",

20 "LICENSE"

21 ],

22 "scripts": {

23 "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc && cp -r src/parser/languages dist/parser/ && chmod +x dist/cli.js dist/server.js && node scripts/restart-daemon-after-build.mjs",

24 "dev": "tsx src/server.ts",

25 "start": "node dist/server.js",

26 "test": "vitest run",

27 "test:watch": "vitest",

28 "test:coverage": "vitest run --coverage",

29 "lint": "biome lint . && tsc --noEmit",

30 "download-wasm": "tsx scripts/download-wasm.ts",

31 "prepublishOnly": "npm run build && npm test",

32 "postinstall": "node ./postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "lint:fix": "biome lint --write . && tsc --noEmit"

34 },

35 "dependencies": {

36 "@manypkg/get-packages": "^3.1.0",

37 "@modelcontextprotocol/core": "^2.0.0",

38 "@modelcontextprotocol/node": "^2.0.0",

39 "@modelcontextprotocol/sdk": "^1.0.0",

40 "@modelcontextprotocol/server": "^2.0.0",

41 "@mrleebo/prisma-ast": "^0.15.0",

42 "@parcel/watcher": "^2.5.6",

43 "@sanity-labs/secret-scan": "^1.1.0",

44 "get-tsconfig": "^4.14.0",

45 "graphology": "^0.26.0",

46 "graphology-metrics": "^2.4.0",

47 "ignore": "^6.0.0",

48 "picomatch": "^4.0.4",

49 "web-tree-sitter": "^0.26.11",

50 "zod": "^4.3.6"

51 },

52 "optionalDependencies": {

dist/tools/pg-introspection.jsView file

Lines 1-33javascript

1/**

2 * PostgreSQL introspection tools.

3 * `pg` is an optional dependency — all imports are dynamic so the module

4 * loads cleanly even when `pg` is not installed.

5 */

6import { buildRelationships, buildTables } from "./pg-introspect-formatters.js";

7export async function loadPgClient

dist/tools/index-tools/snapshots.jsView file

Lines 98-138javascript

98 });

99 }

100 return result;

101}

102export const ASTRO_LOCK_FILENAME = "astro-reindex.lock";

103export const

dist/cli/service.jsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, existsSync, unlinkSync } from "node:fs";

2import { homedir, platform, totalmem } from "node:os";

3import { join, dirname } from "node:path";

4import { isLoopbackHost } from "../utils/loopback.js";

dist/cli/git-hooks-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function resolvebundledhooksdir() { const here = dirname(fileurltopath(import.meta.url)); const candidates = [ join(here, "..", "..", "hooks"), join(here, "..", "..", "..", "hooks"), ]; for (const c of candidates) { if (existssync(c)) return c; } throw new error(`bundled hooks directory not found. looked in: ${candidates.join(", ")}`); } function sha256(content) { return createhash("sha256").update(content).digest("hex"); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/git-hooks-installer.jsView on unpkg

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View on unpkg

dist/tools/index-tools/out-of-process.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/tools/index-tools/out-of-process.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High