Loading npm security reports…

codex-supervisor-mcp@0.5.3: AI-agent control-surface risk | LPM Firewall

registry / codex-supervisor-mcp / 0.5.3

codex-supervisor-mcp@0.5.3

MCP server that dispatches and supervises parallel Codex CLI workers, one isolated Git worktree each, with a persisted work state machine.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global installation automatically modifies foreign AI-agent skill and MCP control surfaces without a consent prompt.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An npm global installation with postinstall enabled and no setup opt-out.

Impact

Future agent sessions can load package-provided instructions and access its worker-dispatch server through persistent client configuration.

Mechanism

Setup detects installed clients, writes the bundled skill into their skill directories, and runs their MCP registration commands.

Policy narrative

The npm postinstall hook invokes quiet automatic setup. On global installs, unless an environment opt-out is set, setup detects foreign agent clients and existing shared skill directories. It installs its skill and registers its local MCP server without asking permission. Although these integrations support the package’s worker-supervision purpose, the automatic mutation crosses foreign and shared agent control surfaces.

AI rationale

The inspected lifecycle path performs unconsented global-install writes to foreign and shared AI-agent control surfaces, meeting the supplied blocking rule. The global-only gate, opt-out, and package-aligned functionality do not establish consent.

Evidence

package.jsonsrc/setup.js~/.agents/skillsskills/codex-supervisor/SKILL.md

Decision evidence

public snapshot

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/setup.js --auto --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

49"postinstall": "node ./src/setup.js --auto --quiet", "setup": "node ./src/setup.js", "start": "node ./src/mcp-server.js",

High

Suspicious Lifecycle Evidence

package.json automatically runs quiet setup during postinstall.

package.jsonView on unpkg · L49

•scripts.postinstall = node ./src/setup.js --auto --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/setup.jsView file

44label: "Claude Code", L45: skillRoot: join(homedir(), ".claude", "skills"), L46: binary: "claude", ... L49: }, L50: { id: "agents", label: "~/.agents", skillRoot: join(homedir(), ".agents", "skills"), binary: null }, L51: { ... L53: label: "Codex", L54: skillRoot: join(homedir(), ".codex", "skills"), L55: binary: "codex", ... L208: } L209: await mkdir(dirname(destination), { recursive: true }); L210: await writeFile(destination, source);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/setup.jsView on unpkg · L44

272if (options.auto) { if (process.env.CODEX_SUPERVISOR_SKIP_SETUP) { return 0; } if (process.env.npm[redacted] !== "true") { return 0; } } const log = options.quiet ? () => {} :

High

Ai Review Evidence

Automatic setup requires a global install and allows an environment opt-out, but requests no consent.

src/setup.jsView on unpkg · L272

45skillRoot: join(homedir(), ".claude", "skills"), binary: "claude", binEnv: null, npmEntry: { pkg: "@anthropic-ai/claude-code", bin: "bin/claude.exe" } }, { id: "agents", label: "~/.agents", skillRoot: join(homedir(), ".agents", "skills"), binary: null }, { id: "codex", label: "Co

High

Ai Review Evidence

Setup targets foreign Claude and Codex clients and the shared agent skill directory.

src/setup.jsView on unpkg · L45

src/bin-resolver.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 29-69json

29 "files": [

30 "src/mcp-server.js",

31 "src/bin-resolver.js",

32 "src/setup.js",

33 "src/codex-runner.js",

34 "src/task-store.js",

35 "src/goal-store.js",

36 "src/event-parser.js",

37 "src/worktree.js",

38 "src/truncate.js",

39 "src/status.js",

40 "src/paths.js",

41 "src/prompt.js",

42 "src/cleanup.js",

43 "src/monitor.jsx",

44 "skills/",

45 "README.md",

46 "LICENSE"

47 ],

48 "scripts": {

49 "postinstall": "node ./src/setup.js --auto --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "setup": "node ./src/setup.js",

51 "start": "node ./src/mcp-server.js",

High

Suspicious Lifecycle Evidence

package.json automatically runs quiet setup during postinstall.

package.jsonView on unpkg · L49

52 "monitor": "tsx ./src/monitor.jsx",

53 "cleanup": "node ./src/cleanup.js",

54 "test": "node ./src/bin-resolver-test.js && node ./src/truncate-test.js && node ./src/status-test.js && node ./src/migration-test.js && node ./src/setup-test.js && node ./src/setup-windows-test.js && node ./src/regression-test.js",

55 "test:real": "node ./src/real-codex-test.js",

56 "smoke": "node ./src/smoke-test.js",

57 "smoke:followup": "node ./src/followup-smoke-test.js",

58 "smoke:mcp": "node ./src/mcp-smoke-test.js",

59 "smoke:mcp-wait": "node ./src/mcp-wait-smoke-test.js"

60 },

61 "dependencies": {

62 "@modelcontextprotocol/sdk": "^1.21.0"

63 },

64 "optionalDependencies": {

65 "ink": "^7.0.2",

66 "react": "^19.2.6",

67 "tsx": "^4.21.0"

68 },

69 "engines": {

src/setup.jsView file

Lines 24-65javascript

24} from "./bin-resolver.js";

25

26const run = promisify(execFile);

27

28const packageRoot = dirname(dirname(fileURLToPath(

src/bin-resolver.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg