Loading npm security reports…

delimit-cli@4.17.0: AI-agent control-surface risk | LPM Firewall

registry / delimit-cli / 4.17.0

delimit-cli@4.17.0

The merge gate for AI-written code, with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A normal CLI invocation can silently alter a foreign AI-agent configuration. The injected instructions direct autonomous email polling and social posting without permission.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running delimit-cli when ~/.gemini/antigravity-cli exists; delimit setup makes further global agent changes.

Impact

An AI agent can be redirected to run package tools and initiate outbound actions without a fresh user confirmation.

Mechanism

Writes agent MCP settings, automatic approval settings, and autonomous action instructions.

Policy narrative

The manifest-reachable CLI entrypoint automatically modifies Antigravity settings whenever that directory exists, rather than requiring setup. It registers the package server, enables automatic editing, and installs instructions that start email polling and tell the agent to send social posts without asking permission. The explicit setup command similarly disables Codex MCP approvals. This is an unconsented AI-agent control-surface change with an autonomous outbound-action instruction chain.

Rationale

Source inspection confirms an automatic foreign agent configuration write and instructions for unapproved outbound actions. The harmless-looking telemetry hook does not mitigate that concrete control-hijack behavior.

Evidence

bin/delimit-cli.jsbin/delimit-setup.jsscripts/postinstall.js~/.gemini/antigravity-cli/settings.json~/.codex/config.toml~/.mcp.json~/.claude/settings.json

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os'); L15: const DELIMIT_HOME = path.join(os.homedir(), '.delimit'); L16: const MCP_CONFIG = path.join(os.homedir(), '.mcp.json'); ... L70: // Self-update check: ensure we're running the latest version (skip if already re-execed) L71: const _pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')); L72: if (!process.env.DELIMIT_SETUP_UPDATED) { L73: try { ... L173: try { L174: execSync(`git clone --depth 1 https://github.com/delimit-ai/delimit-gateway.git "${path.join(DELIMIT_HOME, 'server')}" 2>/dev/null`, { stdio: 'pipe' }); L175: await logp(` ${green('✓')} Core engine cloned`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/delimit-setup.jsView on unpkg · L12

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. step(3, 'configuring claude code mcp...'); const configuredtools = []; let mcpconfig = {}; if (fs.existssync(mcp_config)) { try { mcpconfig = json.parse(fs.readfilesync(mcp_config, 'utf-8')); } catch {} } if (!mcpconfig.mcpservers) mcpconfig.mcpservers = {}; const serverpath = path.join(delimit_home, 'server', 'ai', 'server.py'); const serverpathalt = path.join(delimit_home, 'server', 'mcp-server.py'); const actualserver = fs.existssync(serverpath) ? serverpath : serverpathalt; const delimitmcp = { command: python, args: [actualse

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/delimit-setup.jsView on unpkg

12Trigger-reachable persistence chain: manifest.bin -> bin/delimit-cli.js -> bin/delimit-setup.js L12: const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os'); L15: const DELIMIT_HOME = path.join(os.homedir(), '.delimit'); L16: const MCP_CONFIG = path.join(os.homedir(), '.mcp.json'); ... L70: // Self-update check: ensure we're running the latest version (skip if already re-execed) L71: const _pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')); L72: if (!process.env.DELIMIT_SETUP_UPDATED) { L73: try { ... L173: try { L174: execSync(`git clone --depth 1 https://github.com/delimit-ai/delimit-gateway.git "${path.join(DELIMIT_HOME, 'server')}" 2>/dev/null`, { stdio: 'pipe' }); L175: await logp(` ${green('

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/delimit-setup.jsView on unpkg · L12

76log(dim(` Updating delimit-cli ${_pkg.version} -> ${latest}...`)); L77: execSync('npm install -g delimit-cli@latest 2>/dev/null', { stdio: 'pipe', timeout: 30000 }); L78: execSync('delimit-cli setup', { stdio: 'inherit', env: { ...process.env, DELIMIT_SETUP_UPDATED: '1' } });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/delimit-setup.jsView on unpkg · L76

10*/ L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/delimit-setup.jsView on unpkg · L10

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os'); L15: const DELIMIT_HOME = path.join(os.homedir(), '.delimit'); L16: const MCP_CONFIG = path.join(os.homedir(), '.mcp.json'); ... L70: // Self-update check: ensure we're running the latest version (skip if already re-execed) L71: const _pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')); L72: if (!process.env.DELIMIT_SETUP_UPDATED) { L73: try { ... L173: try { L174: execSync(`git clone --depth 1 https://github.com/delimit-ai/delimit-gateway.git "${path.join(DELIMIT_HOME, 'server')}" 2>/dev/null`, { stdio: 'pipe' }); L175: await logp(` ${green('✓')} Core engine cloned`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/delimit-setup.jsView on unpkg · L12

lib/proxy-handler.jsView file

7L8: const { spawn } = require('child_process'); L9: const axios = require('axios'); L10: const path = require('path'); ... L12: L13: const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`; L14:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/proxy-handler.jsView on unpkg · L7

bin/delimit-cli.jsView file

56} L57: if (!config.mcpServers) config.mcpServers = {}; L58: if (!config.mcpServers.delimit) { L59: const python = process.platform === 'win32' ? 'python.exe' : 'python3'; ... L64: L65: config.mcpServers.delimit = { L66: command: python, ... L77: } L78: fs.writeFileSync(antigravityConfig, JSON.stringify(config, null, 2)); L79: } ... L469: // --- MCP --- L470: const mcpConfigPath = path.join(homedir, '.mcp.json');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/delimit-cli.jsView on unpkg · L56

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/delimit-cli.js: fs.writeFileSync(antigravityConfig, JSON.stringify(config, null, 2)); if (['node_modules', '.next', 'venv', '.git'].includes(entry.name)) continue; fs.writeFileSync('delimit.yml', examplePolicy); console.log(chalk.bold('\nThe following changes will be made:\n')); fs.copyFileSync(profilePath, path.join(backupDir, profile)); fs.writeFileSync(profilePath, content); fs.copyFileSync(configPath, path.join(backupDir, path.basename(configPath) + '.' + label)); fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2));

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/delimit-cli.jsView on unpkg

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/license_core.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 864488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/chat-repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = delimit-cli@4.16.3 matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.16.3 similarity = 0.938 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/chat-repl.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 157-197json

157 "!scripts/demo-v420-deliberation.sh",

158 "!scripts/sync-gateway.sh",

159 "!scripts/build-license-core.sh",

160 "!scripts/security-check.sh",

161 "!scripts/check-bundle-parity.sh",

162 "!scripts/check-bundle-classification.sh",

163 "!scripts/list-blocked-gateway-paths.js",

164 "!scripts/test-license-core-so.sh",

165 "!scripts/test-with-config-guard.js",

166 "!scripts/verify-config-sentinel.js",

167 "server.json",

168 "README.md",

169 "LICENSE",

170 "CHANGELOG.md"

171 ],

172 "bin": {

173 "delimit": "./bin/delimit-cli.js",

174 "delimit-cli": "./bin/delimit-cli.js"

175 },

176 "scripts": {

177 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L177

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L177

178 "sync-gateway": "bash scripts/sync-gateway.sh",

179 "prepublishOnly": "node scripts/clean-tree-guard.js && bash scripts/publish-ci-guard.sh && bash scripts/check-bundle-classification.sh && npm run sync-gateway && bash scripts/build-license-core.sh && bash scripts/security-check.sh && bash scripts/check-bundle-parity.sh",

180 "test": "node scripts/test-with-config-guard.js",

181 "test:raw": "node --test tests/clean-tree-guard.test.js tests/_config-sentinel.test.js tests/setup-onboarding.test.js tests/setup-matrix.test.js tests/setup-no-clobber.test.js tests/config-export-import.test.js tests/cross-model-hooks.test.js tests/golden-path.test.js tests/v420-features.test.js tests/v43-wrap-engine.test.js tests/v43-trust-page-engine.test.js tests/v43-ai-sbom-engine.test.js tests/attest-mcp.test.js tests/delimit-home.test.js tests/postinstall-hardening.test.js tests/auth-signin.test.js tests/auth-signout.test.js tests/migration-2092-banner.test.js tests/control-browser.t ...

182 },

183 "keywords": [

184 "openapi",

185 "swagger",

186 "api",

187 "breaking-changes",

188 "semver",

189 "lint",

190 "linter",

191 "api-governance",

192 "api-contracts",

193 "ci-cd",

194 "github-actions",

195 "migration",

196 "diff",

197 "schema-validation",

Long lines were clipped for display.

bin/delimit-setup.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * delimit setup — Install Delimit MCP governance tools into Claude Code.

4 *

5 * What it does:

6 * 1. Creates ~/.delimit/ directory with the MCP server + core engine

7 * 2. Adds "delimit" to Claude Code's MCP config (~/.mcp.json or .mcp.json)

8 * 3. Installs default agents into ~/.claude/agents/

9 * 4. Prints next steps

10 */

11const

lib/proxy-handler.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3/**

4 * Delimit Proxy Handler - Intercepts AI tool commands

5 * This module wraps AI tools (claude, gemini, codex) with governance

6 */

7

8const { spawn } = require('child_process');

9const

bin/delimit-cli.jsView file

Lines 36-76javascript

36

37const yaml = require('js-yaml');

38

39const continuityContext = resolveContinuityContext();

40process.env.DELIMIT_HOME = continuityContext.delimitHome;

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/license_core.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 864488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/chat-repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = delimit-cli@4.16.3 matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.16.3 similarity = 0.938 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/chat-repl.jsView on unpkg