registry / AI-agent capability abuse / delimit-cli / 4.21.0

delimit-cli@4.21.0

Keep the state. Change the model. Shared context and a multi-model panel across Claude Code, Codex, Cursor, Antigravity, GitHub Copilot, and Muse.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The package has an explicit setup flow that modifies multiple AI-agent control surfaces, including broad MCP approval. The behavior is user-invoked, so it does not meet the threshold for an install-time block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the delimit setup command and proceeds with setup.

Impact

Later AI-agent sessions may invoke Delimit tools or follow its managed instructions with reduced per-tool confirmation.

Mechanism

Setup writes a wildcard Delimit MCP permission in Claude settings and includes code to install managed Codex instructions and hooks.

AI rationale

Evidence

bin/delimit-setup.jslib/cross-model-hooks.js~/.claude/settings.json~/.codex/instructions.md~/.codex/config.json

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs a postinstall hook, but its telemetry path returns unless an affirmative environment flag is set.
The explicit setup command presents the planned AI-assistant configuration and requests confirmation in interactive use.
Setup adds a wildcard approval for all Delimit MCP tools to the user's Claude settings.
The hook installer can add managed session instructions and a Delimit pre-commit command to Codex configuration.

Evidence against

No source evidence shows postinstall changing AI-agent configuration.
No source evidence shows credentials or local files sent to an unrelated endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 899 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.lemonsqueezy.com, api.meta.ai, api.openai.com, api.x.ai, app.delimit.ai, delimit.ai, generativelanguage.googleapis.com, github.com, img.shields.io, jsonfeed.org, python.org, registry.npmjs.org, us-central1-aiplatform.googleapis.com

Source & flagged code

26 flagged

package.jsonView file

Lines 147-187json

147 "gateway/tasks/check_policy_v3.py",

148 "gateway/tasks/explain_diff.py",

149 "gateway/tasks/explain_diff_v2.py",

150 "gateway/tasks/validate_api.py",

151 "gateway/tasks/validate_api_v2.py",

152 "gateway/tasks/validate_api_v3.py",

153 "scripts/postinstall.js",

154 "scripts/muse_mcp.py",

155 "server.json",

156 "npm-shrinkwrap.json",

157 "README.md",

158 "LICENSE",

159 "CHANGELOG.md",

160 "gateway/ai/session_continuity.py"

161 ],

162 "bin": {

163 "delimit": "./bin/delimit-cli.js",

164 "delimit-cli": "./bin/delimit-cli.js"

165 },

166 "scripts": {

167 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L167

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L167

168 "sync-gateway": "bash scripts/sync-gateway.sh",

169 "prepublishOnly": "node scripts/clean-tree-guard.js && bash scripts/publish-ci-guard.sh && bash scripts/check-bundle-classification.sh && bash scripts/gateway-clean-guard.sh && npm run sync-gateway && bash scripts/build-proprietary-core.sh license_core && bash scripts/build-proprietary-core.sh deliberation && bash scripts/security-check.sh && bash scripts/check-bundle-parity.sh",

170 "version": "node scripts/sync-version-sources.js",

171 "test": "node scripts/test-with-config-guard.js",

172 "test:raw": "node --test tests/mcp-subcommand.test.js tests/server-json-guard.test.js tests/claude-plugin-structure.test.js tests/clean-tree-guard.test.js tests/_config-sentinel.test.js tests/setup-onboarding.test.js tests/setup-claude-user-scope.test.js tests/setup-matrix.test.js tests/setup-no-clobber.test.js tests/setup-env-preservation.test.js tests/config-export-import.test.js tests/cross-model-hooks.test.js tests/golden-path.test.js tests/v420-features.test.js tests/v43-wrap-engine.test.js tests/v43-trust-page-engine.test.js tests/v43-ai-sbom-engine.test.js tests/attest-mcp.test.js t ...

173 },

174 "keywords": [

175 "openapi",

176 "swagger",

177 "api",

178 "breaking-changes",

179 "semver",

180 "lint",

181 "linter",

182 "api-governance",

183 "api-contracts",

184 "ci-cd",

185 "github-actions",

186 "migration",

187 "diff",

Long lines were clipped for display.

bin/delimit-setup.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * delimit setup — Install Delimit MCP governance tools into Claude Code.

4 *

5 * What it does:

6 * 1. Creates ~/.delimit/ directory with the MCP server + core engine

7 * 2. Registers "delimit" with Claude Code at user scope and retains ~/.mcp.json

8 * 3. Installs default agents into ~/.claude/agents/

9 * 4. Prints next steps

10 */

11const

lib/proxy-handler.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Delimit Proxy Handler - Intercepts AI tool commands

5 * This module wraps AI tools (claude, gemini, codex) with governance

6 */

8const { spawn } = require('child_process');

9const

bin/delimit-cli.jsView file

Lines 53-93javascript

53 try { return require('../package.json').version; } catch { return 'unknown'; }

54})();

56const continuityContext = resolveContinuityContext();

lib/cross-model-hooks.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ion migratetonestedformat(hookgroup) { if (hookgroup.hooks && array.isarray(hookgroup.hooks)) { return hookgroup; } const nested = { matcher: hookgroup.matcher || '' }; if (hookgroup.if) nested.if = hookgroup.if; nested.hooks = [{ type: hookgroup.type || 'command', command: hookgroup.command }]; return nested; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/cross-model-hooks.jsView on unpkg

lib/auth-setup.jsView file

11Trigger-reachable persistence chain: manifest.bin -> bin/delimit-cli.js -> lib/auth-setup.js L11: const crypto = require('crypto'); L12: const { execSync } = require('child_process'); L13: const chalk = require('chalk'); ... L16: constructor() { L17: this.configDir = path.join(process.env.HOME, '.delimit'); L18: this.credentialsFile = path.join(this.configDir, 'credentials.enc'); ... L183: console.log(chalk.gray('\n Required scopes for full functionality:')); L184: console.log(chalk.gray(' • repo (Full control of private repositories)')); L185: console.log(chalk.gray(' • workflow (Update GitHub Action workflows)')); ... L281: L282: mcp[server].endpoint = await this.prompt(' Endpoint URL (http://localhost:8080): ', 'http://localhost:8080'); L283: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/auth-setup.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/auth-setup.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth-setup.jsView on unpkg

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 2781480 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/agent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/agent.js#virtual:normalized:round1View on unpkg

lib/hooks-installer.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/hooks-installer.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/hooks-installer.jsView on unpkg

lib/agent.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/agent.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/agent.jsView on unpkg

lib/api-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/api-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/api-engine.jsView on unpkg

lib/attest-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/attest-mcp.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/attest-mcp.jsView on unpkg

lib/wrap-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/wrap-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/wrap-engine.jsView on unpkg

bin/delimit.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = bin/delimit.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit.jsView on unpkg

lib/session-shell.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/session-shell.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/session-shell.jsView on unpkg

lib/delimit-template.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/delimit-template.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/delimit-template.jsView on unpkg

lib/platform-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/platform-adapters.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/platform-adapters.jsView on unpkg

lib/trust-page-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/trust-page-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/trust-page-engine.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync, execFileSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

Findings

1 Critical21 High8 Medium5 Low

CriticalAi Agent Control Hijackbin/delimit-cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/delimit-setup.js

HighShell

HighSame File Env Network Executionlib/proxy-handler.js

HighSandbox Evasion Gated Capabilitybin/delimit-setup.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/cross-model-hooks.js

HighTrigger Reachable Persistencelib/auth-setup.js

HighRuntime Package Installbin/delimit-setup.js

HighSemantic Analysis Limitedlib/agent.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/auth-setup.js

Affected versions and remediation

This report applies to delimit-cli@4.21.0.

See all versions of delimit-cli for other recorded verdicts.

Review the evidence and your use of delimit-cli@4.21.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 00:27:54.122Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code