registry / finch-pet / 1.0.3

finch-pet@1.0.3

Desktop pet for Finch.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A startup-activated Finch extension registers local MCP tools for pet management. The `pet_add` tool can fetch a user-supplied image or Petdex page and store the resulting pet asset locally.

Static reason

No blocking static signals were detected.

Trigger

Finch startup registers the extension; an MCP `pet_add` invocation activates remote import.

Impact

Extension storage may receive fetched pet image and metadata; no exfiltration or unsolicited host mutation is established.

Mechanism

Package-owned MCP lifecycle plus user-directed pet import

Rationale

Source inspection does not show malicious behavior, but startup MCP registration combined with broad declared capabilities and remote import warrants a lifecycle-risk warning under the firewall policy.

Evidence

package.jsondist/pet-extension.jsdist/mcp-server.jsdist/management-ipc.jsdist/importers.jsdist/index.js

Network endpoints2

petdex.devassets.petdex.dev

Decision evidence

public snapshot

AI called this at 86.0% confidence with false-positive risk.

finch-pet@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code