registry / lumina-mcp / 1.3.2

lumina-mcp@1.3.2

Unified MCP toolkit for engineering workflows, database connections, and source control

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malware or unconsented lifecycle mutation was found. The package exposes powerful user-invoked MCP tools/prompts for databases, git, PR review, ticket creation, and engineering orchestration, which can modify repositories or send local files to configured services when an agent calls them.

Static reason

One or more suspicious static signals were detected.

Trigger

User configures/runs the lumina-mcp MCP server and invokes its tools/prompts through an MCP client.

Impact

Could commit/push code, create/review PRs, query databases, write audit docs, or upload specified local attachments if delegated to the agent.

Mechanism

User-invoked MCP agent capability surface with git, database, ticketing, and remote API actions.

Attack narrative

The package does not execute at install time or plant agent configuration. When run as an MCP server, it intentionally gives an AI client broad developer-workflow powers: database reads/audits, GitHub/Gitea PR actions, git commit/push, issue creation, local report writes, and optional attachment uploads. These are dangerous if delegated carelessly but are package-aligned and user-invoked rather than stealthy malware.

Rationale

Static inspection found a legitimate MCP automation toolkit with powerful agent-facing capabilities but no install hook abuse, credential harvesting loop, hidden exfiltration, persistence, or unconsented writes to foreign AI-agent control surfaces. Because the exposed tools/prompts can modify repos and upload specified files when invoked, warn rather than mark clean.

Evidence

package.jsondist/index.jsREADME.mddist/skills/fallback-brainstorm.mddist/skills/fallback-work.mddist/skills/fallback-review.mddist/skills/fallback-compound.mddocs/database/auditor-query-*.mdattachmentPath arguments~/.claude.jsonClaude/Cursor/Cline/Roo config paths

Network endpoints5

api.github.com*.atlassian.net/rest/api/3api.trello.com/1<openproject-domain>/api/v3GITEA_BASE_URL

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js registers agent tools that can git add/commit/push selected files via child_process execFile.
dist/index.js prompt content instructs agents to create files, run tests/install commands, and fall back to git/gh/tea CLI workflows.
dist/index.js reads home/project AI-tool config paths to detect compound-engineering/ce-work presence.
dist/index.js can read arbitrary attachmentPath files for Jira/OpenProject uploads when create-ticket tools are invoked.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; only bin/main point to dist/index.js.
Runtime is an MCP stdio server; sensitive actions are exposed as named tools/prompts, not import-time or install-time execution.
Database tools enforce read-only SQL and filter common sensitive columns from returned rows.
Network endpoints are package-aligned: GitHub, Gitea, Atlassian/Jira, Trello, OpenProject, MySQL/PostgreSQL configured by user env.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 123 KB of source, external domains: api.github.com, api.trello.com, gitea.example.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 266-306javascript

266 nodes {

267 id

268 isResolved

269 comments(first: 50) {

270 nodes {

271 id

272 }

273 }

274 }

275 }

276 }

277 }

278 }

279 `,variables:{owner:o,repo:s,prNumber:t}})})).data?.repository?.pullRequest?.reviewThreads?.nodes||[]).find(m=>m.comments.nodes.some(g=>g.id===r));if(!l)throw new Error(`Could not find a review thread containing comment with node_id ${r}`);return l.isResolved?{success:!0,message:"Thread is already resolved"}:this.fetchFromGithub("/graphql",{method:"POST",body:JSON.stringify({query:`

280 mutation($threadId: ID!) {

281 resolveReviewThread(input: { threadId: $threadId }) {

282 thread {

283 isResolved

284 }

285 }

286 }

287 `,variables:{threadId:l.id}})})}},x=new me;import{exec as mr,execFile as gr}from"child_process";import{promisify as Ue}from"util";var De=Ue(mr),ge=Ue(gr);async function $e(n,e,t,r){try{if(!t||t.length===0)throw new Error("No files specified to commit. AI must specify explicitly which files to add.");await ge("git",["add",...t]);let{stdout:o,stderr:s}=await ge("git",["commit","-m",e]),{stdout:a,stderr:i}=await ge("git",["push","origin",n]);return{success:!0,stdout:`${o}

288${a}`.trim(),stderr:`${s}

289${i}`.trim()}}catch(o){let s=o instanceof Error?o.message:String(o);throw new Error(`Failed to commit and push: ${s}`)}}async function He(){try{let{stdout:n}=await De("git diff --staged"),{stdout:e}=await De("git diff"),t="";return n&&(t+=`Staged Changes:

290${n}

291

292`),e&&(t+=`Unstaged Changes:

293${e}

294

295`),t||"No local changes detected."}catch{return"Failed to read local git changes."}}async function je(n,e,t,r,o){return await x.createPullRequest(n,e,t,r,o)}async function Fe(n,e,t,r,o){return await x.createCodeReview(n,e,t,r,o)}async function Qe(n,e){return await x.getPRReviewComments(n,e)}async function Be(n,e){return await x.getPullRequestDiff(n,e)}async function Je(n,e,t,r){return await x.replyToPRComment(n,e,t,r)}async function Ye(n,e,t){return await x.resolvePRReviewThread(n,e,t)}import{z as u}from"zod";var Ke=u.object({branch:u.string().describe("Branch name to commit and push to"),file ...

296- **GitHub / Git Tool Execution & Fallback Rules**:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L286

297 If you need to perform any GitHub or Git operations (such as committing, pushing, creating a pull request, submitting/replying to a review, or fetching PR details), you MUST execute them following this strict fallback order:

298 1. **Primary**: Try calling the corresponding 'lumina-mcp' tool (e.g., 'generate_commit_and_push', 'create_github_pr', 'review_github_pr', 'fix_github_pr_review').

299 2. **Secondary (Official GitHub MCP Fallback)**: If the primary tool fails or throws an error (for example, due to a missing or invalid GITHUB_TOKEN environment variable or a GitHub API permission error), check if the official GitHub MCP server ('github') is registered and active in your environment. If it is, call the corresponding tool from the official GitHub MCP server instead.

300 3. **Tertiary (GitHub CLI Fallback)**: If the official GitHub MCP server is not registered/active or also fails, execute the task using local shell commands via the GitHub CLI ('gh' CLI) or git CLI (e.g., run 'gh pr create', 'gh pr review', 'git commit', 'git push') on the terminal.

301 Always inspect any tool failure and transition immediately to the next fallback option without giving up or reporting a failure to the user.

302`,hr=`

303You MUST act as a strict senior engineer writing a professional commit message that follows standard IT company conventions (Conventional Commits + Ticket traceability + AI authorship transparency).

304

305- **Staging Rules**:

306 - Stage ONLY the files that you have created or modified for this specific feature. Do NOT blindly use \`git add .\`.

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/index.jsView file

286} L287: `,variables:{threadId:l.id}})})}},x=new me;import{exec as mr,execFile as gr}from"child_process";import{promisify as Ue}from"util";var De=Ue(mr),ge=Ue(gr);async function $e(n,e,t,r)... L288: ${a}`.trim(),stderr:`${s} ... L294: L295: `),t||"No local changes detected."}catch{return"Failed to read local git changes."}}async function je(n,e,t,r,o){return await x.createPullRequest(n,e,t,r,o)}async function Fe(n,e,t... L296: - **GitHub / Git Tool Execution & Fallback Rules**:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L286

Findings

1 High2 Medium4 Low

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 266-306javascript

266 nodes {

267 id

268 isResolved

269 comments(first: 50) {

270 nodes {

271 id

272 }

273 }

274 }

275 }

276 }

277 }

278 }

280 mutation($threadId: ID!) {

281 resolveReviewThread(input: { threadId: $threadId }) {

282 thread {

283 isResolved

284 }

285 }

286 }

288${a}`.trim(),stderr:`${s}

290${n}

291

292`),e&&(t+=`Unstaged Changes:

293${e}

294

296- **GitHub / Git Tool Execution & Fallback Rules**:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L286

298 1. **Primary**: Try calling the corresponding 'lumina-mcp' tool (e.g., 'generate_commit_and_push', 'create_github_pr', 'review_github_pr', 'fix_github_pr_review').

301 Always inspect any tool failure and transition immediately to the next fallback option without giving up or reporting a failure to the user.

302`,hr=`

304

305- **Staging Rules**:

306 - Stage ONLY the files that you have created or modified for this specific feature. Do NOT blindly use \`git add .\`.

Long lines were clipped for display.