registry / dba-master / 0.0.17

dba-master@0.0.17

MCP server para introspecção profunda de bancos Oracle, voltado a consumo por agentes de IA

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `dba-master install` or configures/runs its MCP server.

Impact

Selected agent clients gain access to the configured database; writes require READ_ONLY=false.

Mechanism

Interactive first-party MCP/agent setup plus Oracle introspection and SQL execution.

Rationale

The package is not malicious by source evidence, but it has an intentional high-impact agent/database capability and writes agent configuration only after explicit user action. Flag as a warning for this capability rather than block it.

Evidence

package.jsondist/src/index.jsdist/setup/index.jsdist/setup/install-mcp.jsdist/setup/install-agents.jsdist/src/mcp/tools/run-sql.tool.jsagents/commands/dba-investigate.mddist/src/infrastructure/oracle/oracle-connection.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence with false-positive risk.

dba-master@0.0.17

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code