mcp-agents-memory@0.9.15
Long-term memory for AI agents with provenance tracking
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAutomatic collection of local agent-session content on normal server startup is a concrete, privacy-sensitive agent capability. The inspected code lacks a confirmed external exfiltration sink or install hook, so blocking as malware is not supported.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the package's default MCP-server command.
Impact
Private user and assistant conversation content can be retained in the configured memory database without a separate capture opt-in.
Mechanism
Startup invokes session-capture routines; the Codex routine reads rollout records under the user's Codex directory and submits parsed messages to the package memory store.
AI rationale
Automatic collection of local agent-session content on normal server startup is a concrete, privacy-sensitive agent capability. The inspected code lacks a confirmed external exfiltration sink or install hook, so blocking as malware is not supported.
Evidence
build/index.js~/.codex/sessions~/.codex/state_5.sqlite
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The normal MCP-server startup automatically starts six session-capture routines.
- The Codex capture routine targets the user's Codex sessions directory.
- Captured user and assistant messages are passed to the memory insertion function.
- The package has no install lifecycle hook; its prepare script is a no-op.
- The required migration performs a scoped database schema change.
Evidence against
- No concrete external exfiltration endpoint was established from the inspected paths.
- No install-time execution or foreign agent-configuration write was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
30 flaggedbuild/migrations/023_librarian_gate.jsView file
9195patternName = private_key_rsa
severity = critical
line = 9195
Critical
Critical Secret
Package contains a critical-looking secret pattern.
build/migrations/023_librarian_gate.jsView on unpkg · L91959195patternName = private_key_rsa
severity = critical
line = 9195
Critical
Secret Pattern
RSA private key in build/migrations/023_librarian_gate.js
build/migrations/023_librarian_gate.jsView on unpkg · L919512898var { readFile } = __require("fs");
L12899: var { execFile, spawn } = __require("child_process");
L12900: var { isParsedKey, parseKey } = require_keyParser();
High
Child Process
Package source references child process execution.
build/migrations/023_librarian_gate.jsView on unpkg · L12898Findings
27 Critical3 High3 Medium5 Low
CriticalCritical Secretbuild/migrations/023_librarian_gate.js
CriticalRemote Asset Decode Executebuild/index.js
CriticalRemote Response Code Executionbuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
CriticalSecret Patternbuild/migrations/023_librarian_gate.js
CriticalSecret Patternbuild/migrations/025_project_tag_alias_suggestions.js
CriticalSecret Patternbuild/migrations/014_drop_legacy_facts_constraints.js
CriticalSecret Patternbuild/migrations/008_schema_realignment.js
CriticalSecret Patternbuild/migrations/015_agent_provenance.js
CriticalSecret Patternbuild/migrations/010_subject_relationships.js
Affected versions and remediation
This report applies to mcp-agents-memory@0.9.15.
See all versions of mcp-agents-memory for other recorded verdicts.
- Review the evidence and your use of mcp-agents-memory@0.9.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.