registry / grape-context / 1.0.0

grape-context@1.0.0

The context infrastructure layer between a repository and an AI coding agent.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `grape mcp --install --client claude|cursor|codex`.

Impact

Adds or updates the `grape` MCP server entry; Claude Desktop may be configured outside the project.

Mechanism

Explicit MCP client configuration merge.

Rationale

Static inspection found a user-invoked AI-agent configuration capability, including a user-level Claude Desktop target, but no lifecycle trigger, remote endpoint, credential theft, or stealth behavior. Warn under the explicit-user-command agent-control policy.

Evidence

package.jsondist/cli/index.jsdist/cli/commands/mcp.jsdist/app/local-project/setup/mcp-client-config.jsdist/core/security/secret-scan.jsdist/app/local-project/setup/initialize.js.cursor/mcp.json.codex/config.tomlClaude/claude_desktop_config.json.grape/config.json.grape/grape.db.git/info/exclude

grape-context@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code