integram-mcp@0.7.149
MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe updater creates a real, conditional remote code execution risk because it can apply remote code and install dependencies without a separate confirmation. Since it is limited to Git checkouts and uses that checkout’s configured remote, this supports a warning rather than a block.
Decision evidence
public snapshot- package.json exposes index.js as the CLI and has no install lifecycle hook.
- CLI startup calls the updater immediately and repeats it hourly.
- The updater checks that its directory is a Git checkout, pulls from its configured remote, and compares revisions.
- A changed revision triggers npm install and a process restart.
- The cited runtime locations concern a local update-check cache and CLI startup; they do not establish an authenticated account action.
- The update path only proceeds when the package directory is a Git repository; the remote is configured by that checkout, not fixed in the source.
Source & flagged code
3 flagged · loading sourceThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
index.jsView on unpkgPackage source invokes a package manager install command at runtime.
index.jsView on unpkg · L2379Findings
Affected versions and remediation
This report applies to integram-mcp@0.7.149.
See all versions of integram-mcp for other recorded verdicts.
- Review the evidence and your use of integram-mcp@0.7.149 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.