registry / glyph-compress / 1.19.0

glyph-compress@1.19.0

Semantic compression for IDE↔LLM communication using radical glyphs — CLI, MCP server, and VS Code extension, with a Context Router, team-shared dictionaries, and compression calibrated against real provider tokenizers.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time behavior occurs. The VS Code extension can, after opt-in configuration, write GlyphCompress instructions into workspace AI-agent rule files; its explicit proxy forwards compressed requests to the configured provider.

Static reason

No blocking static signals were detected.

Trigger

Install and activate the VS Code extension with autoUpdateWorkspaceRules enabled; or explicitly start the proxy.

Impact

Modifies .cursorrules and .github/copilot-instructions.md in the open workspace; proxy transmits user-supplied LLM requests to its configured upstream.

Mechanism

Opt-in AI workspace-rule mutation and local HTTP request forwarding

Rationale

No concrete malicious chain was found, but the guarded extension writes to AI-agent control-surface files. Per policy this is a warn-level extension lifecycle risk, not a publish block.

Evidence

package.jsonvscode-ext/package.jsonvscode-ext/extension.jssrc/proxy.jssrc/logger.jsbin/cli.jsbin/mcp-server.js.cursorrules.github/copilot-instructions.md

Network endpoints1

api.openai.com

glyph-compress@1.19.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code