integram-mcp@0.7.150

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest has no consumer install hook, and the flagged package-manager command is limited to the Git-based update path. The account-action hints point to update-check and CLI startup code, not automatic account changes.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Starting the CLI starts the update checks; the Git update path requires a valid checkout and a changed revision.

Impact

The inspected behavior is consistent with package update handling; no concrete attack surface was established.

Mechanism

The version check fetches package tags. In a Git checkout, the updater performs a fast-forward-only pull and runs npm install only if the checkout changed.

AI rationale

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

package.json exposes index.js as the command and defines only test and prepublishOnly scripts, both running a version check.
The flagged cache path belongs to the update checker, which honors opt-out variables and stores update metadata in the temporary directory.
The updater and version check start when the CLI runs; the entrypoint starts the server only when invoked as the program.
The version checker fetches package dist-tags from the configured npm registry; it does not install an update.
The Git updater requires a Git checkout, uses fast-forward-only pulls, and runs npm install only after the checkout changes; errors such as a missing Git repository are skipped.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

3 flagged

index.jsView file

Lines 2331-2399javascript

2331

2332 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

2333 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

2334 const { tools, restored } = await loadWorkspaceTools(slug);

2335

2336 log(`Switched to workspace "${slug}", ${activeTools.size} tools loaded (${restored} restored from memory)`);

2337 memoryBriefingWs = null;

2338 checkMemoryBriefing();

2339

2340 return {

2341 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} active${restored ? `, ${restored} restored from previous activation` : ', core only'}). Use search_tools to activate more.` }],

2342 };

2343 } catch (err) {

2344 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

2345 }

2346}

2347

2348// ─── Bootstrap ───────────────────────────────────────────────────────────────

2349

2350// ─── Auto-update from git ────────────────────────────────────────────────────

2351

2352import { execSync } from 'child_process';

2353import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2351

2354import { dirname } from 'path';

2355import { fileURLToPath } from 'url';

2356

2357const __dirname = dirname(fileURLToPath(import.meta.url));

2358const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

2359

2360function tryAutoUpdate() {

2361 try {

2362 // Слепое пятно git pull: в дев-дереве репо уезжает вперёд ЛОКАЛЬНЫМИ

2363 // коммитами (bump-on-change поднимает версию при правках mcp-server),

2364 // и pull отвечает «Already up to date», не замечая смены кода под

2365 // процессом. Поэтому версия из package.json на диске сверяется с

2366 // запущенной ПЕРВЫМ делом — расхождение само по себе повод к рестарту.

2367 const diskVersion = createRequire(import.meta.url)('./package.json').version;

2368 if (cmpVersion(diskVersion, PKG.version) !== 0) {

2369 log(`Version on disk is ${diskVersion}, running ${PKG.version} — restarting to pick it up...`);

2370 log('Shutting down gracefully...');

2371 setTimeout(() => process.exit(0), 2000);

2372 return;

2373 }

2374 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

2375 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

2376 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

2377 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

2378 if (before !== after) {

2379 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

2380 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

2381 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2379

2382 log('Shutting down gracefully...');

2383 setTimeout(() => process.exit(0), 2000);

2384 }

2385 } catch { /* not a git repo or offline — skip */ }

2386}

2387

2388async function main() {

2389 tryAutoUpdate();

2390 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

2391

2392 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

2393 checkForUpdate();

2394 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

2395

2396 log(`integram-mcp ${PKG.version}`);

2397 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

2398

2399 // 1. Login

•matchType = previous_version_dangerous_delta matchedPackage = integram-mcp@0.7.104 matchedIdentity = npm:aW50ZWdyYW0tbWNw:0.7.104 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

3 flagged · loading source

index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

2351L2352: import { execSync } from 'child_process'; L2353: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2351

2379log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L2380: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L2381: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2379

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltaindex.js

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.150.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.150 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 10:12:09.438Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.