halfcycle@0.4.0
Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.
AI Security Review
scanned 23d ago · by lpm-firewall-aiNo npm lifecycle hook runs the integration automatically, and the inspected credential flows target Halfcycle services. The installed Claude Code hooks do process later project edits and send change data to the guard service, so this first-party agent extension merits a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the package CLI install command in a project; subsequent Claude Code session and file-edit events activate the installed hooks.
Impact
The guard service receives project change data, and Claude Code automatically runs the installed commands at configured events.
Mechanism
The hooks inspect edit events, build a change set and send it with the engagement token to the guard service. The installer also registers the Halfcycle MCP server.
AI rationale
No npm lifecycle hook runs the integration automatically, and the inspected credential flows target Halfcycle services. The installed Claude Code hooks do process later project edits and send change data to the guard service, so this first-party agent extension merits a warning.
Evidence
dist/bin.jsdist/index.jsbin/bin.bundle.mjsdist/engagement-credential.d.ts.claude/settings.json.claude/hooks/guard-runner.sh.mcp.json.halfcycle/bin/bin.bundle.mjs
Network endpoints2
control.halfcycle.aiguard.halfcycle.ai
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and lists build, typecheck and test scripts; it has no npm install lifecycle hook.
- The explicit install path writes Claude settings and hook scripts, and registers the Halfcycle MCP server.
- The shipped hook wiring schedules commands for Claude Code session and tool events; the declarations describe the guard runner loading the engagement credentials.
- After Edit or Write events, the runner builds a change set and posts it to the guard service with a bearer token.
- The CLI sends the account credential to the configured or default Halfcycle control service; engagement credentials authorize requests to the service URLs returned for that engagement.
Evidence against
- The agent integration is activated by running the package CLI install command, rather than by npm installation.
- The inspected credential flows use the Halfcycle control service and engagement-specific service URLs; no unrelated credential recipient was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
5 flaggedbin/bin.bundle.mjsView file
15700// dist/git.js
L15701: import { spawnSync } from "node:child_process";
L15702: import { readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L15700dist/bin.jsView file
3070// dist/control-origin.js
L3071: var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
L3072: function resolveControlOrigin(env = process.env) {
L3073: const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
...
L3082: // dist/device-signin.js
L3083: import { spawn } from "node:child_process";
L3084: import { platform as platform3 } from "node:os";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin.jsView on unpkg · L30703252function defaultWrite(text) {
L3253: process.stdout.write(text);
L3254: }
L3255: function defaultSleep(ms) {
L3256: return new Promise((resolve4) => setTimeout(resolve4, ms));
L3257: }
...
L3262: return {
L3263: command: "cmd.exe",
L3264: args: ["/d", "/s", "/c", `"start "" "${url}""`],
Findings
5 High2 Medium5 Low
HighChild Processbin/bin.bundle.mjs
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
HighCross File Remote Execution Contextdist/bin.js
HighTrigger Reachable Command Output Exfiltrationdist/bin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to halfcycle@0.4.0.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.