registry / Remote code execution / integram-mcp / 0.7.16

integram-mcp@0.7.16

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The automatic pull-and-install behavior is an active, conditional remote code supply path unrelated to ordinary MCP request handling. It warrants a warning, but the Git-repository guard and absence of an install lifecycle hook do not establish malicious install-time behavior in this release.

Static reason

One or more suspicious static signals were detected.

Trigger

Executing the integram-mcp command in a Git checkout triggers the check immediately and then hourly.

Impact

A configured remote can supply changed code or dependencies that are installed without a separate user confirmation.

Mechanism

The updater runs git pull against the checkout's configured remote and, after a change, runs npm install in that directory.

AI rationale

Evidence

index.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The executable entry point is index.js and package scripts contain no install lifecycle hook.
At program startup, the code immediately runs an automatic update check and schedules it hourly.
When its installed directory is a Git repository, the updater pulls from its configured remote without user interaction.
After a changed pull, the updater runs npm install in the package directory, which can run dependency lifecycle code.

Evidence against

The automatic update path is conditional on the package directory being a Git repository.
The inspected manifest has no preinstall, install, or postinstall script.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 139 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

index.jsView file

Lines 2130-2186javascript

2130 const tools = await fetchTools();

2131 activeTools.clear();

2132 for (const t of tools) {

2133 if (t.group === 'core' && !BUILT_IN_NAMES.has(t.name)) activeTools.set(t.name, t);

2134 }

2135

2136 await server.sendToolListChanged();

2137 log(`Switched to workspace "${slug}", ${activeTools.size} core tools loaded`);

2138

2139 return {

2140 content: [{ type: 'text', text: `Switched to workspace "${slug}". Loaded ${tools.length} tools (${activeTools.size} core active). Use search_tools to activate more.` }],

2141 };

2142 } catch (err) {

2143 return { content: [{ type: 'text', text: `Error switching workspace: ${err.message}` }], isError: true };

2144 }

2145}

2146

2147// ─── Bootstrap ───────────────────────────────────────────────────────────────

2148

2149// ─── Auto-update from git ────────────────────────────────────────────────────

2150

2151import { execSync } from 'child_process';

2152import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2150

2153import { dirname } from 'path';

2154import { fileURLToPath } from 'url';

2155

2156const __dirname = dirname(fileURLToPath(import.meta.url));

2157const AUTO_UPDATE_INTERVAL = 60 * 60 * 1000; // check every hour

2158

2159function tryAutoUpdate() {

2160 try {

2161 execSync('git rev-parse --git-dir', { cwd: __dirname, stdio: 'ignore' });

2162 const before = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

2163 execSync('git pull --ff-only', { cwd: __dirname, stdio: 'ignore', timeout: 15000 });

2164 const after = execSync('git rev-parse HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();

2165 if (before !== after) {

2166 log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`);

2167 try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {}

2168 // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2166

2169 log('Shutting down gracefully...');

2170 setTimeout(() => process.exit(0), 2000);

2171 }

2172 } catch { /* not a git repo or offline — skip */ }

2173}

2174

2175async function main() {

2176 tryAutoUpdate();

2177 setInterval(tryAutoUpdate, AUTO_UPDATE_INTERVAL);

2178

2179 // Не ждём: запуск сервера не должен зависеть от доступности реестра npm.

2180 checkForUpdate();

2181 setInterval(checkForUpdate, UPDATE_CHECK_INTERVAL_MS).unref();

2182

2183 log(`integram-mcp ${PKG.version}`);

2184 log(`Connecting to ${BASE_URL}, workspace "${workspace || '(not set)'}"`);

2185

2186 // 1. Login

package.jsonView file

Lines 1-37json

2 "name": "integram-mcp",

3 "version": "0.7.16",

4 "type": "module",

5 "description": "MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol",

Source & flagged code

3 flagged · loading source

index.jsView file

2150L2151: import { execSync } from 'child_process'; L2152: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2150

2166log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L2167: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L2168: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2166

package.jsonView file

18], "bin": { "integram-mcp": "./index.js" }, "scripts": { "test": "node scripts/check-versions.mjs", "prepublishOnly": "node script

Medium

Suspicious Lifecycle Evidence

The executable entry point is index.js and package scripts contain no install lifecycle hook.

package.json

Findings

3 High4 Medium5 Low

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.16.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 09:51:37.915Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.