registry / incremnt / 0.8.8

incremnt@0.8.8

Command-line tool for querying your incremnt strength training data

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `incremnt mcp install`.

Impact

The user-invoked command can cause supported AI clients to launch this package's MCP server; runtime requests may send opted-in training data to its configured service.

Mechanism

Explicit MCP configuration registration plus authenticated training-data API client.

Rationale

The scanner's lifecycle alert is a false positive because postinstall only writes a console message. The explicit MCP-registration capability warrants a warning under the stated policy, but source inspection found no concrete malicious chain.

Evidence

package.jsonsrc/lib.jssrc/mcp.jssrc/state.jssrc/service-url.jssrc/remote.js~/.claude.json~/.codex/config.tomlClaude/claude_desktop_config.jsonincremnt/session.json

Network endpoints2

incremnt-sync.onrender.comopenrouter.ai/api/v1

incremnt@0.8.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code