registry / lelu-mcp / 0.0.30

lelu-mcp@0.0.30

Model Context Protocol (MCP) server for Lelu — gives AI agents secure, policy-gated access to your infrastructure

AI Security Review

scanned 5h ago · by lpm-firewall-ai

A user-invoked `start` can download and execute an unsigned Lelu engine binary. An explicit `add --write` can configure a first-party MCP server in the current project; no install-time mutation occurs.

Static reason

No blocking static signals were detected.

Trigger

Run `lelu-mcp start` without an engine URL, or `lelu-mcp add --cursor|--open-code --write`.

Impact

A compromised release asset could execute with the invoking user's privileges; explicit config setup enables the package's MCP server.

Mechanism

Unsigned remote binary download and execution; explicit MCP config write.

Rationale

The package is not shown to be malicious, but its default runtime path executes an unsigned downloaded binary and offers explicit MCP configuration writes. Downgrade to a warning rather than block because activation is user-invoked and no covert or install-time attack was found.

Evidence

package.jsondist/cli.jsdist/chunk-FDCPDYU6.jsREADME.md~/.lelu/bin/lelu-engine-{os}-{arch}~/.lelu/engine.key~/.lelu/policy.yaml.cursor/mcp.json.opencode/mcp.json

Network endpoints2

github.com/Lelu-ai/lelu/releases/latest/download/${asset}github.com/Lelu-ai/lelu/releases/download/engine-v${version}/${asset}

lelu-mcp@0.0.30

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code