Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
User runs `godot-mcp-enhanced setup`.
Impact
A configured AI client can subsequently launch the package's Godot MCP server with project access.
Mechanism
Writes MCP client configuration and invokes `codex mcp add`.
Rationale
No concrete malicious chain, exfiltration, remote payload loading, or install-time foreign control-surface mutation was found. The explicit AI-client configuration capability warrants a warning under the stated policy.
Evidence
package.jsonbuild/index.jsbuild/cli/setup.jsbuild/cli/clients/codex.jsbuild/cli/clients/claude-code.jsbuild/core/EditorConnection.jsproject/.claude/settings.jsonproject/.cursor/mcp.jsonproject/opencode.json
Network endpoints2
127.0.0.1:<instance-port>/api/<tool>ws://127.0.0.1:<port>