codesift-mcp@0.22.0
MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package automatically invokes first-party agent setup during npm installation, creating an agent extension lifecycle risk. The inspected path does not establish a concrete malicious attack, so this warrants a warning rather than a publication block.
Decision evidence
public snapshot- The npm postinstall hook launches setup for all supported platforms automatically.
- Setup can install platform hooks and agent rules, and the Codex setup writes configuration under the user’s home directory.
- This is first-party package-owned agent setup; the inspected source does not establish a malicious payload or credential theft.
- The inspected code does not show a network transmission or credential collection in this setup path.
Source & flagged code
23 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/storage/sqlite/native-sqlite.jsView on unpkg · L70Findings
Affected versions and remediation
This report applies to codesift-mcp@0.22.0.
See all versions of codesift-mcp for other recorded verdicts.
- Review the evidence and your use of codesift-mcp@0.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.