registry / codesift-mcp / 0.24.0

codesift-mcp@0.24.0

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The install hook automatically configures this package in AI client environments, which warrants a warning under the agent extension setup policy. Inspected source does not support a block-level attack finding.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm runs its postinstall hook.

Impact

AI clients may load the CodeSift MCP server and package-provided rules after installation.

Mechanism

The hook launches `codesift setup all`, which runs setup handlers across supported platforms and can write CodeSift configuration or rules.

AI rationale

Evidence

package.jsonpostinstall.mjsdist/postinstall.jsdist/cli/setup.jsdist/cli/setup/codex.jsdist/cli/setup/rules.js~/.codex/config.toml.claude/rules/codesift.md.cursor/rules/codesift.mdc

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook runs `postinstall.mjs`, which starts `codesift setup all`.
`setupAll` runs setup for every supported platform; Codex setup targets the user’s `~/.codex/config.toml`.
The package includes setup rules for Claude and Cursor configuration directories.

Evidence against

The inspected setup path configures this package’s own MCP server and rules; it does not establish a broader agent-control takeover or credential transfer.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 683 file(s), 4.11 MB of source, external domains: 100.103.91.24, 127.0.0.1, api.openai.com, api.osv.dev, api.voyageai.com, cdn.jsdelivr.net, docs.astro.build, github.com, huggingface.co, pypi.org, rollupjs.org, vite.dev, www.apple.com, yourdomain.com, zod.dev

Source & flagged code

23 flagged

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/storage/sqlite/native-sqlite.jsView file

70// Every name is quoted by JSON.stringify, so no column alias can become code. L71: factory = new Function(...params, `return { __proto__: null, ${props.join(", ")} };`); L72: if (rowFactories.size >= MAX_ROW_FACTORIES)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/storage/sqlite/native-sqlite.jsView on unpkg · L70

dist/tools/pg-introspection.jsView file

13const pgSpecifier = "pg"; L14: const mod = (await import(/* @vite-ignore */ pgSpecifier)); L15: // Handle both ESM default-export and CJS named-export shapes.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/pg-introspection.jsView on unpkg · L13

dist/tools/index-tools/snapshots.jsView file

118const raw = await readFile(versionsPath, "utf-8"); L119: storedVersions = JSON.parse(raw); L120: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/index-tools/snapshots.jsView on unpkg · L118

dist/cli/service.jsView file

6Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/cli/commands.js -> dist/cli/commands-admin.js -> dist/cli/service.js L6: import { fileURLToPath } from "node:url"; L7: import { execFileSync } from "node:child_process"; L8: /** ... L92: export function buildServicePlan(opts) { L93: const home = opts.home ?? homedir(); L94: const os = opts.os ?? platform(); ... L109: unitPath, L110: stdoutLog: join(logDir, "daemon.out.log"), L111: stderrLog: join(logDir, "daemon.err.log"), ... L158: */ L159: export function resolveDaemonHeapMb(totalRamBytes, env = process.env) { L160: const override = Number(env["CODESIFT_DAEMON_HEAP_MB"]);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/service.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/cli/service.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/service.jsView on unpkg

6import { fileURLToPath } from "node:url"; L7: import { execFileSync } from "node:child_process"; L8: /** ... L92: export function buildServicePlan(opts) { L93: const home = opts.home ?? homedir(); L94: const os = opts.os ?? platform(); ... L109: unitPath, L110: stdoutLog: join(logDir, "daemon.out.log"), L111: stderrLog: join(logDir, "daemon.err.log"), ... L158: */ L159: export function resolveDaemonHeapMb(totalRamBytes, env = process.env) { L160: const override = Number(env["CODESIFT_DAEMON_HEAP_MB"]);

dist/cli/git-hooks-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function resolvebundledhooksdir() { const here = dirname(fileurltopath(import.meta.url)); const candidates = [ join(here, "..", "..", "hooks"), join(here, "..", "..", "..", "hooks"), ]; for (const c of candidates) { if (existssync(c)) return c; } throw new error(`bundled hooks directory not found. looked in: ${candidates.join(", ")}`); } function sha256(content) { return createhash("sha256").update(content).digest("hex"); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/git-hooks-installer.jsView on unpkg

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View on unpkg

dist/tools/index-tools/out-of-process.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/tools/index-tools/out-of-process.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/index-tools/out-of-process.jsView on unpkg

dist/cli/setup/mcp.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/cli/setup/mcp.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup/mcp.jsView on unpkg

dist/cli/auto-prune.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/cli/auto-prune.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/auto-prune.jsView on unpkg

dist/cli/hooks/post-tool-use.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/cli/hooks/post-tool-use.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/hooks/post-tool-use.jsView on unpkg

dist/tools/project-profile-extractors.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/tools/project-profile-extractors.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/project-profile-extractors.jsView on unpkg

dist/cli/commands-daemon.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/cli/commands-daemon.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands-daemon.jsView on unpkg

dist/cli/hooks/pre-tool-use.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/cli/hooks/pre-tool-use.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/hooks/pre-tool-use.jsView on unpkg

dist/lsp/lsp-tools.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/lsp/lsp-tools.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lsp/lsp-tools.jsView on unpkg

dist/register-tools/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/register-tools/runtime.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/register-tools/runtime.jsView on unpkg

dist/tools/wiki-module-builder.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/tools/wiki-module-builder.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/wiki-module-builder.jsView on unpkg

dist/tools/patterns/adapters/php.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = [redacted].js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/patterns/adapters/php.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/storage/sqlite/native-sqlite.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/storage/sqlite/native-sqlite.jsView on unpkg · L70

Findings

16 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/git-hooks-installer.js

HighTrigger Reachable Persistencedist/cli/service.js

HighSemantic Analysis Limiteddist/cli/hooks/pre-tool-use.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/tools/index-tools/out-of-process.js

HighKnown Malware Source Similaritydist/cli/service.js

HighKnown Malware Source Similaritydist/cli/setup/mcp.js

HighKnown Malware Source Similaritydist/cli/auto-prune.js

HighKnown Malware Source Similaritydist/cli/hooks/post-tool-use.js

HighKnown Malware Source Similaritydist/tools/project-profile-extractors.js

Affected versions and remediation

This report applies to codesift-mcp@0.24.0.

See all versions of codesift-mcp for other recorded verdicts.

Review the evidence and your use of codesift-mcp@0.24.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 11:10:36.822Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code