registry / m9r-cli / 0.6.16

m9r-cli@0.6.16

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The source shows a first-party agent capture integration that modifies project-level agent configuration when set up through the CLI. The reviewed evidence does not establish an npm install trigger or a concrete malicious chain, so this is a warning-level capability.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user invokes the CLI’s agent connection or setup flow.

Impact

Agent session content can be captured into M9R’s local memory and may be handled by the product’s runtime.

Mechanism

Setup adds project-local agent hooks or a plugin that records session activity for M9R.

AI rationale

Evidence

dist/cross-agent-capture-setup-core.js

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes `m9r` and `oathlock` CLI entrypoints, with no install lifecycle hook in its manifest.
The setup code adds a project-local SessionEnd hook for Claude Code and Codex while preserving existing hook groups.
The generated OpenCode plugin captures session activity into M9R’s local memory; this is a first-party agent integration capability.

Evidence against

The reviewed setup behavior is tied to CLI setup and project-local agent configuration, not an npm install hook.
The Codex hook is written for a separate in-product trust review before it runs.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 135 file(s), 2.13 MB of source, external domains: 127.0.0.1, en.wikipedia.org, m9r-dashboard.onrender.com, m9r-relay.m9r.workers.dev, m9r.dev, m9r.invalid, opencode.ai, www.apple.com

Source & flagged code

12 flagged

dist/resident-provider-adapters.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

3import { redactSession } from "./session-redaction.js";

4import { extractCost, extractTokenUsage } from "./usage-normalization.js";

5import { providerLabel } from "./provider-adapter-config.js";

6import { createGrantWorktree, quarantineGrantWorktree, removeGrantWorktree, worktreeHeadCommit } from "./resident-write-isolation.js";

7/**

8 * The provider CLI's stream-json events already carry usage/cost — Claude

9 * Code's final `result` event and Codex's `turn.completed`/`token_count`

10 * events. Scans every event and keeps the last reported usage block (later

11 * events report cumulative totals, so last-wins beats summing per-event

12 * deltas and risking double count).

13 */

14function extractProviderUsage(events) {

15 const merged = { inputTokens: null, outputTokens: null, totalTokens: null, costUsd: null };

16 let sawAny = false;

17 for (const event of events) {

18 const tokens = extractTokenUsage(event);

19 const cost = extractCost(event);

20 if (tokens.usage === null && cost.costUsd === null)

21 continue;

dist/acp-stdio-adapter.jsView file

Lines 600-640javascript

600 capabilities.usage_reporting = true;

601 capabilities.tool_event_reporting = true;

602 capabilities.approval_requests = true;

603 capabilities.repository_editing = true;

604 capabilities.file_event_reporting

dist/m9r-web-broker.cjsView file

Lines 27-67javascript

27 // "default" to the CommonJS "module.exports" for node compatibility.

28 isNodeMode || !mod || !mod.__esModule ? __defProp(target2, "default", { value: mod, enumerable: true }) : target2,

29 mod

30));

dist/oathlock.jsView file

Lines 1648-1693javascript

1648 catch { /* keep polling */ }

1649 if (brokerReady)

1650 break;

1651 await new Promise((resolveWait) => setTimeout(resolveWait,

dist/m9r.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * M9R CLI v0 — entrypoint

4 * ----------------------------------------------------------------------------

5 * Thin wrapper that wires the testable core (src/lib/m9r-cli-core.ts) to

6 * real IO: global fetch, the filesystem, process env/cwd, stdout/stderr, and a

7 * best-effort browser open. All command logic lives in the core so it can be

8 * unit-tested without a network or repo writes.

9 *

10 * Run it via the package script:

dist/cross-agent-capture-setup-core.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rately minimal: no dependencies, no network, one append, exit. // never throws into the caller -- claude code/codex treat this hook as // advisory and non-blocking, but a stack trace on stderr would still be // a needless surprise in someone's terminal on session exit. import { appendfile, mkdir } from "node:fs/promises"; import { dirname, join } from "node:path"; const provider = process.argv[2] === "codex" ? "codex" : "claude-code"; function readstdin() { return new promise((resolve) => { let data = ""; process.stdin.setencoding("utf8"); process.stdin.on("data", (chunk) => { data += chunk; }); process.stdin.on("end", () => resolve(data)); process.stdin.on("err

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cross-agent-capture-setup-core.jsView on unpkg

dist/native-commands.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. copyfilesync, existssync, mkdirsync, readfilesync, rmsync, rmdirsync, statsync, writefilesync } from "node:fs"; import { createhash, randomuuid } from "node:crypto"; import { basename, dirname, join } from "node:path"; import { fileurltopath } from "node:url"; import { hook_marker, unparseableconfigerror, applystandinginstruction, decideuninstall, hasourhooks, mergehooks, mergemcpserverjson, mergemcpservertoml, removehooks, removemcpserverjson, removemcpservertoml, removestandinginstruction, sha256, standinginstructionstatus, } from "./install-core.js"; import { createlocalstore, defaultstoreroot, handleforprovider } from "./local-store.js"; import { codexhome, delivertocodex, r

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/native-commands.jsView on unpkg

Source & flagged code

12 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = m9r-cli@0.6.3 matchedIdentity = npm:bTlyLWNsaQ:0.6.3 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

620// Node deprecates (DEP0190) passing a separate args array alongside L621: // shell: true -- with a shell, args are concatenated into the shell L622: // command line unescaped, so a non-empty args array is a footgun even

Findings

1 Critical10 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock.js

HighCredential Redirect Persistencedist/m9r.js

HighCommand Output Exfiltrationdist/oathlock.js

HighExternal Ai Agent Control Surface Mutationdist/cross-agent-capture-setup-core.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/native-commands.js

HighCross File Remote Execution Contextdist/m9r.js

HighTrigger Reachable Command Output Exfiltrationdist/m9r.js

High

Affected versions and remediation

This report applies to m9r-cli@0.6.16.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 09:48:15.419Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.