registry / AI-agent control-surface risk / codesift-mcp / 0.25.0

codesift-mcp@0.25.0

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The npm lifecycle trigger automatically mutates global AI-agent configuration and installs hooks into Claude's tool execution path without an affirmative consent step. This is an unconsented postinstall change to an agent control surface, so it warrants blocking.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm runs its postinstall hook.

Impact

The install changes the user's agent configuration and places package commands in Claude's tool execution path.

Mechanism

The hook launches setup all with hooks enabled by default; platform setup writes global agent configuration without an interactive consent prompt.

Policy narrative

An npm install runs postinstall, which invokes setup all. Hooks are enabled by default, and the all-platform setup writes global agent configuration. Claude setup inserts CodeSift command hooks for common tool actions into the user's settings file without asking for consent.

AI rationale

Evidence

package.jsondist/postinstall.jsdist/cli/commands-admin.jsdist/cli/setup.jsdist/cli/setup/claude.js~/.claude/settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest declares an npm postinstall hook that runs the package's postinstall entry.
The postinstall entry launches the CLI with setup all without an interactive consent step.
The setup command enables hooks by default, and setup all runs setup for each supported platform.
Per-platform setup invokes hook installers, including for Claude.
Claude setup adds CodeSift hooks to the user-level settings file and saves the updated settings.
The added hooks run before Read, Bash, Glob, Grep, and Agent actions.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 686 file(s), 4.17 MB of source, external domains: 100.103.91.24, 127.0.0.1, api.openai.com, api.osv.dev, api.voyageai.com, cdn.jsdelivr.net, docs.astro.build, github.com, huggingface.co, pypi.org, rollupjs.org, vite.dev, www.apple.com, yourdomain.com, zod.dev

Source & flagged code

23 flagged

package.jsonView file

Lines 13-53json

13 "files": [

14 "dist",

15 "postinstall.mjs",

16 "rules",

17 "hooks",

18 "src/parser/languages",

19 "README.md",

20 "LICENSE"

21 ],

22 "scripts": {

23 "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc && cp -r src/parser/languages dist/parser/ && chmod +x dist/cli.js dist/server.js && node scripts/restart-daemon-after-build.mjs",

24 "build:native": "node scripts/build-native.mjs",

25 "dev": "tsx src/server.ts",

26 "start": "node dist/server.js",

27 "test": "vitest run",

28 "test:watch": "vitest",

29 "test:coverage": "vitest run --coverage",

30 "lint": "biome lint . && tsc --noEmit",

31 "download-wasm": "tsx scripts/download-wasm.ts",

32 "prepublishOnly": "npm run build && npm test",

33 "postinstall": "node ./postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "lint:fix": "biome lint --write . && tsc --noEmit"

35 },

36 "dependencies": {

37 "@manypkg/get-packages": "^3.1.0",

38 "@modelcontextprotocol/core": "^2.3.1",

39 "@modelcontextprotocol/node": "^2.1.1",

40 "@modelcontextprotocol/sdk": "^1.0.0",

41 "@modelcontextprotocol/server": "^2.3.1",

42 "@mrleebo/prisma-ast": "^0.15.0",

43 "@parcel/watcher": "^2.6.0",

44 "@sanity-labs/secret-scan": "^1.1.0",

45 "get-tsconfig": "^4.14.0",

46 "graphology": "^0.26.0",

47 "graphology-metrics": "^2.4.2",

48 "ignore": "^7.0.6",

49 "picomatch": "^4.0.4",

50 "web-tree-sitter": "^0.26.11",

51 "zod": "^4.3.6"

52 },

53 "optionalDependencies": {

dist/storage/sqlite/native-sqlite.jsView file

Lines 50-90javascript

50}

51/** Compiled row constructors by column list. Bounded: a list is a query shape, and there are few. */

52const rowFactories = new Map();

53const MAX_ROW_FACTORIES = 512;

54/**

dist/tools/pg-introspection.jsView file

Lines 1-33javascript

1/**

2 * PostgreSQL introspection tools.

3 * `pg` is an optional dependency — all imports are dynamic so the module

4 * loads cleanly even when `pg` is not installed.

5 */

6import { buildRelationships, buildTables } from "./pg-introspect-formatters.js";

7export async function loadPgClient

dist/tools/index-tools/worktree-overlay.jsView file

Lines 69-109javascript

69 finally {

70 db.close();

71 }

72}

73/**

74 * The donor's uncommitted and untracked paths (both sides of a rename). Throws when git cannot say:

75 * the list is baked into an immutable base, and an empty one would leave every overlay on it holding

76 * the donor's edits as if they were this tree's content.

77 */

dist/cli/service.jsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, existsSync, unlinkSync } from "node:fs";

2import { homedir, platform, totalmem } from "node:os";

3import { join, dirname } from "node:path";

4import { isLoopbackHost } from "../utils/loopback.js";

dist/cli/git-hooks-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function resolvebundledhooksdir() { const here = dirname(fileurltopath(import.meta.url)); const candidates = [ join(here, "..", "..", "hooks"), join(here, "..", "..", "..", "hooks"), ]; for (const c of candidates) { if (existssync(c)) return c; } throw new error(`bundled hooks directory not found. looked in: ${candidates.join(", ")}`); } function sha256(content) { return createhash("sha256").update(content).digest("hex"); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/git-hooks-installer.jsView on unpkg

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View on unpkg

dist/tools/index-tools/out-of-process.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.21.1 matchedPath = dist/tools/index-tools/out-of-process.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High