integram-mcp@0.7.57

MCP server for Integram — connect AI assistants to your workspace via Model Context Protocol

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest has no install-time hook, and the runtime updater is conditional on the package directory being a Git checkout. The scanner signals do not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the CLI starts the update check and attempts the Git updater.

Impact

No confirmed harmful effect was identified.

Mechanism

The updater checks for a Git repository before pulling; package installation runs only if the revision changes.

AI rationale

The manifest has no install-time hook, and the runtime updater is conditional on the package directory being a Git checkout. The scanner signals do not establish malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes index.js as the CLI and has only a prepublishOnly check, with no install hook.
The updater first requires the package directory to be a Git repository before pulling; the npm dependency install is conditional on a changed revision.
The CLI starts the update check at runtime, and the registry request retrieves package version tags.

Evidence against

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 249 KB of source, external domains: api.example.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

4 flagged

index.jsView file

Lines 10-50javascript

10 * INTEGRAM_SKIP_HITL — set to "true" to auto-confirm all HITL prompts (for automation)

11 */

13// ─── SOCKS/HTTP proxy for MCP calls (reads HTTPS_PROXY env) ─────────────────

14import { EnvHttpProxyAgent, setGlobalDispatcher } from 'undici';

15if (process.env.HTTPS_PROXY || process.env.HTTP_PROXY) {

16 setGlobalDispatcher(new EnvHttpProxyAgent());

17}

19import { Server } from '@modelcontextprotocol/sdk/server/index.js';

20import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

21import {

22 ListToolsRequestSchema,

23 CallToolRequestSchema,

24} from '@modelcontextprotocol/sdk/types.js';

25import { createRequire } from 'module';

26import { rememberActivation as rememberActivationIn, applyActivation, forgetActivation } from './activation-memory.js';

27import { startOrphanWatchdog } from './orphan-watchdog.js';

29// Own identity — read from package.json, never hardcoded: a hardcoded copy drifts

30// (it sat at 0.5.0 through the 0.6.0 and 0.7.0 releases).

31const PKG = createRequire(import.meta.url)('./package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L30

33const BASE_URL = (process.env.INTEGRAM_URL || 'http://localhost:8081').replace(/\/$/, '');

34const EMAIL = process.env.INTEGRAM_EMAIL;

35const PASSWORD = process.env.INTEGRAM_PASSWORD;

36let workspace = process.env.INTEGRAM_WORKSPACE || '';

37const SKIP_HITL = process.env.INTEGRAM_SKIP_HITL === 'true';

39// ─── Auth state ──────────────────────────────────────────────────────────────

41let accessToken = null;

42let refreshToken = null;

43let tokenExp = 0; // epoch seconds

44let _authPromise = null;

46async function apiFetch(path, opts = {}, _retried = false) {

47 const url = `${BASE_URL}${path}`;

48 const headers = { 'Content-Type': 'application/json', ...opts.headers };

49 if (accessToken) headers['Authorization'] = `Bearer ${accessToken}`;

50 const res = await fetch(url, { ...opts, headers });

Lines 2924-2980javascript

2924 rememberActivation();

2925 workspace = slug;

2926

2927 // Загрузить инструменты целевого воркспейса: ядро + восстановленная

2928 // из памяти активация (инцидент 05.09.2026 — см. блок у activationMemory).

2929 const { tools, restored } = await loadWorkspaceTools(slug);

•matchType = previous_version_dangerous_delta matchedPackage = integram-mcp@0.7.44 matchedIdentity = npm:aW50ZWdyYW0tbWNw:0.7.44 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

4 flagged · loading source

index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

2944L2945: import { execSync } from 'child_process'; L2946: import { realpathSync } from 'fs';

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2944

2960log(`Updated ${before.slice(0, 7)} → ${after.slice(0, 7)}, restarting...`); L2961: try { execSync('npm install --omit=dev', { cwd: __dirname, stdio: 'ignore', timeout: 30000 }); } catch {} L2962: // Allow pending responses to drain before exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L2960

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltaindex.js

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to integram-mcp@0.7.57.

See all versions of integram-mcp for other recorded verdicts.

Review the evidence and your use of integram-mcp@0.7.57 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 10:08:39.842Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.