registry / glovrex-connect / 0.4.0

glovrex-connect@0.4.0

Wire one or many MCP servers into Claude Code, Claude Desktop, Cursor, Windsurf, Cline, and Continue with one command, with signed provenance receipts for every change. Also scaffolds Island-constrained Glovrex apps.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `glovrex-connect install` or `install-all` with `--apply`.

Impact

Registers commands and environment values for AI-agent MCP hosts; a supplied server can run under those hosts.

Mechanism

explicit MCP configuration wiring and optional provenance POST

Rationale

Source inspection found an explicit user-invoked MCP wiring tool with optional configured provenance networking, not autonomous malicious behavior. Warn for its dangerous dual-use AI-agent configuration capability.

Evidence

package.jsonbin/cli.mjslib/hosts.mjslib/registry.mjslib/provenance.mjslib/receipts.mjslib/util.mjs

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `install --apply` mutates MCP host configurations.

glovrex-connect@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Findings