registry / AI-agent control-surface risk / codesift-mcp / 0.21.1

codesift-mcp@0.21.1

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall chain invokes setup across multiple agent platforms with hooks and rules enabled by default, changing agent configuration without an explicit user setup command. This matches the policy for blocking unconsented postinstall mutation of broad AI-agent control surfaces.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm and its lifecycle scripts enabled.

Impact

Agent behavior and configuration can be changed during package installation without the user explicitly invoking setup.

Mechanism

Postinstall runs `setup all`; setup defaults enable hooks and rules, and iterates over supported platforms to write their configuration.

Policy narrative

During npm installation, the package automatically runs setup across several AI agent platforms. The setup defaults enable hooks and rules and write agent configuration, including Codex settings. This is an unconsented install-time mutation of broad agent control surfaces.

AI rationale

Evidence

package.jsondist/postinstall.jsdist/cli/commands-admin.jsdist/cli/setup.jsdist/cli/setup/codex.jsdist/cli/setup/rules.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs postinstall.mjs automatically during npm installation.
The postinstall script launches `codesift setup all` without setup flags.
Setup defaults enable hooks and rules, and `all` iterates across six agent platforms.
Platform setup writes agent hooks and rules; Claude setup also installs global instructions.
Codex setup writes its config under `.codex` and can change approval settings for CodeSift tools.
Rules setup targets agent rule files and, for some platforms, appends to project instruction files.

Evidence against

The changes configure this package as an MCP server, which aligns with its stated product purpose.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

16 flagged

package.jsonView file

Lines 13-53json

13 "files": [

14 "dist",

15 "postinstall.mjs",

16 "rules",

17 "hooks",

18 "src/parser/languages",

19 "README.md",

20 "LICENSE"

21 ],

22 "scripts": {

23 "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc && cp -r src/parser/languages dist/parser/ && chmod +x dist/cli.js dist/server.js && node scripts/restart-daemon-after-build.mjs",

24 "build:native": "node scripts/build-native.mjs",

25 "dev": "tsx src/server.ts",

26 "start": "node dist/server.js",

27 "test": "vitest run",

28 "test:watch": "vitest",

29 "test:coverage": "vitest run --coverage",

30 "lint": "biome lint . && tsc --noEmit",

31 "download-wasm": "tsx scripts/download-wasm.ts",

32 "prepublishOnly": "npm run build && npm test",

33 "postinstall": "node ./postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "lint:fix": "biome lint --write . && tsc --noEmit"

35 },

36 "dependencies": {

37 "@manypkg/get-packages": "^3.1.0",

38 "@modelcontextprotocol/core": "^2.0.0",

39 "@modelcontextprotocol/node": "^2.0.0",

40 "@modelcontextprotocol/sdk": "^1.0.0",

41 "@modelcontextprotocol/server": "^2.0.0",

42 "@mrleebo/prisma-ast": "^0.15.0",

43 "@parcel/watcher": "^2.5.6",

44 "@sanity-labs/secret-scan": "^1.1.0",

45 "get-tsconfig": "^4.14.0",

46 "graphology": "^0.26.0",

47 "graphology-metrics": "^2.4.0",

48 "ignore": "^6.0.0",

49 "picomatch": "^4.0.4",

50 "web-tree-sitter": "^0.26.11",

51 "zod": "^4.3.6"

52 },

53 "optionalDependencies": {

dist/storage/sqlite/native-sqlite.jsView file

Lines 50-90javascript

50}

51/** Compiled row constructors by column list. Bounded: a list is a query shape, and there are few. */

52const rowFactories = new Map();

53const MAX_ROW_FACTORIES = 512;

54/**

dist/tools/pg-introspection.jsView file

Lines 1-33javascript

1/**

2 * PostgreSQL introspection tools.

3 * `pg` is an optional dependency — all imports are dynamic so the module

4 * loads cleanly even when `pg` is not installed.

5 */

6import { buildRelationships, buildTables } from "./pg-introspect-formatters.js";

7export async function loadPgClient

dist/tools/index-tools/snapshots.jsView file

Lines 98-138javascript

98 });

99 }

100 return result;

101}

102export const ASTRO_LOCK_FILENAME = "astro-reindex.lock";

103export const

dist/cli/service.jsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, existsSync, unlinkSync } from "node:fs";

2import { homedir, platform, totalmem } from "node:os";

3import { join, dirname } from "node:path";

4import { isLoopbackHost } from "../utils/loopback.js";

dist/cli/git-hooks-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function resolvebundledhooksdir() { const here = dirname(fileurltopath(import.meta.url)); const candidates = [ join(here, "..", "..", "hooks"), join(here, "..", "..", "..", "hooks"), ]; for (const c of candidates) { if (existssync(c)) return c; } throw new error(`bundled hooks directory not found. looked in: ${candidates.join(", ")}`); } function sha256(content) { return createhash("sha256").update(content).digest("hex"); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/git-hooks-installer.jsView on unpkg

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View on unpkg

dist/cli/hooks/post-tool-use.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.15.5 matchedPath = dist/cli/hooks/post-tool-use.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.15.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High