registry / codesift-mcp / 0.26.0

codesift-mcp@0.26.0

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The source confirms that npm postinstall automatically configures this package’s MCP integration across supported agent clients, including approval of its Codex tools. This is a first-party agent integration lifecycle risk; the inspected runtime call sites did not establish a separate attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled.

Impact

Supported agents may load the package’s tools without a separate setup command; Codex configuration also approves those tools.

Mechanism

The postinstall launches `setup all`, which writes the package’s MCP server entry into client configuration files.

AI rationale

Evidence

package.jsonpostinstall.mjsdist/postinstall.jsdist/cli/setup.jsdist/cli/setup/mcp.jsdist/cli/setup/codex.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs a postinstall wrapper, which imports the built installer when present.
The installer launches `setup all`; setup iterates through six supported agent clients and invokes each client’s configuration handler.
The handlers write a `codesift` MCP server entry to client configuration. Codex setup also sets approval to `approve` for this package’s tools.
The Codex configuration path and the Claude and Cursor rule destinations were inspected; hooks and rules require setup flags.
The flagged runtime sites concern file watching, indexing and symbol lookup, not authenticated account actions.
The automatic registration is a first-party agent integration, but its install-time configuration change warrants a warning.

Evidence against

The postinstall call passes no hooks or rules flags, and those setup actions are conditional. The inspected runtime hints do not establish a separate account mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

23 flagged

package.jsonView file

Lines 13-53json

13 "files": [

14 "dist",

15 "postinstall.mjs",

16 "rules",

17 "hooks",

18 "src/parser/languages",

19 "README.md",

20 "LICENSE"

21 ],

22 "scripts": {

23 "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc && cp -r src/parser/languages dist/parser/ && chmod +x dist/cli.js dist/server.js && node scripts/restart-daemon-after-build.mjs",

24 "build:native": "node scripts/build-native.mjs",

25 "dev": "tsx src/server.ts",

26 "start": "node dist/server.js",

27 "test": "vitest run",

28 "test:watch": "vitest",

29 "test:coverage": "vitest run --coverage",

30 "lint": "biome lint . && tsc --noEmit",

31 "download-wasm": "tsx scripts/download-wasm.ts",

32 "prepublishOnly": "npm run build && npm test",

33 "postinstall": "node ./postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "lint:fix": "biome lint --write . && tsc --noEmit"

35 },

36 "dependencies": {

37 "@manypkg/get-packages": "^3.1.0",

38 "@modelcontextprotocol/core": "^2.3.1",

39 "@modelcontextprotocol/node": "^2.1.1",

40 "@modelcontextprotocol/sdk": "^1.0.0",

41 "@modelcontextprotocol/server": "^2.3.1",

42 "@mrleebo/prisma-ast": "^0.15.0",

43 "@parcel/watcher": "^2.6.0",

44 "@sanity-labs/secret-scan": "^1.1.0",

45 "get-tsconfig": "^4.14.0",

46 "graphology": "^0.26.0",

47 "graphology-metrics": "^2.4.2",

48 "ignore": "^7.0.6",

49 "picomatch": "^4.0.4",

50 "web-tree-sitter": "^0.26.11",

51 "zod": "^4.3.6"

52 },

53 "optionalDependencies": {

dist/storage/sqlite/native-sqlite.jsView file

70// Every name is quoted by JSON.stringify, so no column alias can become code. L71: factory = new Function(...params, `return { __proto__: null, ${props.join(", ")} };`); L72: if (rowFactories.size >= MAX_ROW_FACTORIES)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/storage/sqlite/native-sqlite.jsView on unpkg · L70

dist/tools/pg-introspection.jsView file

13const pgSpecifier = "pg"; L14: const mod = (await import(/* @vite-ignore */ pgSpecifier)); L15: // Handle both ESM default-export and CJS named-export shapes.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/pg-introspection.jsView on unpkg · L13

dist/tools/index-tools/worktree-overlay.jsView file

89const prefix = meta(db, OVERLAY_BASE_PREFIX_KEY) ?? `${meta(db, "repo") ?? ""}:`; L90: const dirty = JSON.parse(meta(db, BASE_DIRTY_KEY) ?? "[]"); L91: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/index-tools/worktree-overlay.jsView on unpkg · L89

dist/cli/service.jsView file

6Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/cli/commands.js -> dist/cli/commands-admin.js -> dist/cli/service.js L6: import { fileURLToPath } from "node:url"; L7: import { execFileSync } from "node:child_process"; L8: /** ... L92: export function buildServicePlan(opts) { L93: const home = opts.home ?? homedir(); L94: const os = opts.os ?? platform(); ... L109: unitPath, L110: stdoutLog: join(logDir, "daemon.out.log"), L111: stderrLog: join(logDir, "daemon.err.log"), ... L158: */ L159: export function resolveDaemonHeapMb(totalRamBytes, env = process.env) { L160: const override = Number(env["CODESIFT_DAEMON_HEAP_MB"]);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/service.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/cli/service.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/service.jsView on unpkg

6import { fileURLToPath } from "node:url"; L7: import { execFileSync } from "node:child_process"; L8: /** ... L92: export function buildServicePlan(opts) { L93: const home = opts.home ?? homedir(); L94: const os = opts.os ?? platform(); ... L109: unitPath, L110: stdoutLog: join(logDir, "daemon.out.log"), L111: stderrLog: join(logDir, "daemon.err.log"), ... L158: */ L159: export function resolveDaemonHeapMb(totalRamBytes, env = process.env) { L160: const override = Number(env["CODESIFT_DAEMON_HEAP_MB"]);

dist/cli/git-hooks-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function resolvebundledhooksdir() { const here = dirname(fileurltopath(import.meta.url)); const candidates = [ join(here, "..", "..", "hooks"), join(here, "..", "..", "..", "hooks"), ]; for (const c of candidates) { if (existssync(c)) return c; } throw new error(`bundled hooks directory not found. looked in: ${candidates.join(", ")}`); } function sha256(content) { return createhash("sha256").update(content).digest("hex"); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/git-hooks-installer.jsView on unpkg

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/hooks/pre-tool-use.js#virtual:normalized:round1View on unpkg

dist/tools/index-tools/out-of-process.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/tools/index-tools/out-of-process.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/index-tools/out-of-process.jsView on unpkg

dist/cli/setup/mcp.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/cli/setup/mcp.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup/mcp.jsView on unpkg

dist/cli/auto-prune.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/cli/auto-prune.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/auto-prune.jsView on unpkg

dist/cli/commands-maintenance.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/cli/commands-maintenance.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands-maintenance.jsView on unpkg

dist/cli/hooks/post-tool-use.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/cli/hooks/post-tool-use.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/hooks/post-tool-use.jsView on unpkg

dist/server.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/server.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.jsView on unpkg

dist/tools/project-profile-extractors.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/tools/project-profile-extractors.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/project-profile-extractors.jsView on unpkg

dist/cli/commands-daemon.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/cli/commands-daemon.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands-daemon.jsView on unpkg

dist/cli/hooks/pre-tool-use.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/cli/hooks/pre-tool-use.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/hooks/pre-tool-use.jsView on unpkg

dist/lsp/lsp-tools.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/lsp/lsp-tools.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lsp/lsp-tools.jsView on unpkg

dist/register-tools/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.25.0 matchedPath = dist/register-tools/runtime.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/register-tools/runtime.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/storage/sqlite/native-sqlite.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/storage/sqlite/native-sqlite.jsView on unpkg · L70

Findings

16 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/git-hooks-installer.js

HighTrigger Reachable Persistencedist/cli/service.js

HighSemantic Analysis Limiteddist/cli/hooks/pre-tool-use.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/tools/index-tools/out-of-process.js

HighKnown Malware Source Similaritydist/cli/service.js

HighKnown Malware Source Similaritydist/cli/setup/mcp.js

HighKnown Malware Source Similaritydist/cli/auto-prune.js

HighKnown Malware Source Similaritydist/cli/commands-maintenance.js

HighKnown Malware Source Similaritydist/cli/hooks/post-tool-use.js

Affected versions and remediation

This report applies to codesift-mcp@0.26.0.

See all versions of codesift-mcp for other recorded verdicts.

Review the evidence and your use of codesift-mcp@0.26.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 16:31:24.299Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code