registry / m9r-cli / 0.6.13

m9r-cli@0.6.13

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source shows a user-triggered agent connection or capture-install workflow that configures session capture and local storage. No confirmed malicious transfer or other attack behavior was established in the inspected capture path.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user connects an agent or invokes capture installation for a project.

Impact

Connected agent sessions may be captured and stored locally for shared memory.

Mechanism

The integration records session data in a project-local spool, which the CLI later processes into local memory files.

AI rationale

Evidence

dist/oathlock-cli-core.jsdist/cross-agent-capture-setup-core.jsdist/cross-agent-capture-core.js.oathlock/bin/m9r-capture.mjs.claude/settings.local.json.codex/hooks.json.opencode/plugins/m9r-memory.js.oathlock/capture/pending.jsonl.oathlock/memory/local/

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI installs cross-agent capture when connecting an agent and also provides a user-invoked capture-install path.
Capture setup writes a hook or plugin into the connected project’s agent configuration.
The generated hook records session metadata and a transcript path in a local capture spool; the drainer processes jobs into local memory files.
The inspected capture path presents a guarded agent-session capture capability; it does not establish an unconsented external transfer.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 66 file(s), 1020 KB of source, external domains: 127.0.0.1, m9r-dashboard.onrender.com, m9r-relay.m9r.workers.dev, m9r-web-staging.m9r.workers.dev, oathlock.vercel.app, opencode.ai, www.apple.com

Source & flagged code

8 flagged

dist/resident-provider-adapters.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

3import { redactSession } from "./session-redaction.js";

4import { extractCost, extractTokenUsage } from "./usage-normalization.js";

5import { providerLabel } from "./provider-adapter-config.js";

6import { createGrantWorktree, quarantineGrantWorktree, removeGrantWorktree, worktreeHeadCommit } from "./resident-write-isolation.js";

7/**

8 * The provider CLI's stream-json events already carry usage/cost — Claude

9 * Code's final `result` event and Codex's `turn.completed`/`token_count`

10 * events. Scans every event and keeps the last reported usage block (later

11 * events report cumulative totals, so last-wins beats summing per-event

12 * deltas and risking double count).

13 */

14function extractProviderUsage(events) {

15 const merged = { inputTokens: null, outputTokens: null, totalTokens: null, costUsd: null };

16 let sawAny = false;

17 for (const event of events) {

18 const tokens = extractTokenUsage(event);

19 const cost = extractCost(event);

20 if (tokens.usage === null && cost.costUsd === null)

21 continue;

dist/acp-stdio-adapter.jsView file

Lines 600-640javascript

600 capabilities.usage_reporting = true;

601 capabilities.tool_event_reporting = true;

602 capabilities.approval_requests = true;

603 capabilities.repository_editing = true;

604 capabilities.file_event_reporting

dist/oathlock-terminal-bridge.jsView file

Lines 1-30javascript

1import { createServer } from "node:http";

2import { open, readFile, stat, mkdir } from "node:fs/promises";

3import { createWriteStream } from "node:fs";

4import { randomBytes } from "node:crypto"

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View file

18import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M9R local runtime is already running on ${host}:${port}.\n`); L30: process.exit(0);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View on unpkg · L18

18Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/m9r.js -> dist/oathlock-terminal-bridge.js L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M

High

dist/cross-agent-capture-setup-core.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rately minimal: no dependencies, no network, one append, exit. // never throws into the caller -- claude code/codex treat this hook as // advisory and non-blocking, but a stack trace on stderr would still be // a needless surprise in someone's terminal on session exit. import { appendfile, mkdir } from "node:fs/promises"; import { dirname, join } from "node:path"; const provider = process.argv[2] === "codex" ? "codex" : "claude-code"; function readstdin() { return new promise((resolve) => { let data = ""; process.stdin.setencoding("utf8"); process.stdin.on("data", (chunk) => { data += chunk; }); process.stdin.on("end", () => resolve(data)); process.stdin.on("err

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cross-agent-capture-setup-core.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = m9r-cli@0.6.3 matchedIdentity = npm:bTlyLWNsaQ:0.6.3 similarity = 0.640 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

620// Node deprecates (DEP0190) passing a separate args array alongside L621: // shell: true -- with a shell, args are concatenated into the shell L622: // command line unescaped, so a non-empty args array is a footgun even

Findings

1 Critical7 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock-terminal-bridge.js

HighCommand Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationdist/cross-agent-capture-setup-core.js

HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/acp-stdio-adapter.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to m9r-cli@0.6.13.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 09:51:32.640Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.