registry / mcp-agents-memory / 0.9.30
mcp-agents-memory@0.9.30
Long-term memory for AI agents with provenance tracking
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged Typesafe request is an optional project-tagging feature gated by JEV_ENABLED=true and uses a Typesafe key with the Typesafe endpoint. The OpenAI client uses the standard OpenAI key and service, while the manifest's prepare script runs only true.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
JEV_ENABLED=true and a project-tag judgment request; ordinary OpenAI use follows the selected model provider.
Impact
When enabled, project messages and candidate tags are sent to Typesafe for classification. No credential redirection or concealed remote code execution was established.
Mechanism
The judge reads a Typesafe key from TYPESAFE_API_KEY or a fixed local key path, then authorizes a request to https://api.typesafe.ai/v1/systemone.
AI rationale
The flagged Typesafe request is an optional project-tagging feature gated by JEV_ENABLED=true and uses a Typesafe key with the Typesafe endpoint. The OpenAI client uses the standard OpenAI key and service, while the manifest's prepare script runs only true.
Evidence
build/index.js/home/admin_3alab/.config/typesafe/api_key
Network endpoints2
api.typesafe.aiapi.openai.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes build/index.js as the package entry and CLI; its prepare script runs only true.
- The Typesafe judge is gated on JEV_ENABLED being exactly true.
- The judge sends requests to api.typesafe.ai using a Typesafe API key, not an OpenAI key.
- The OpenAI client uses OPENAI_API_KEY with its default OpenAI service endpoint.
Evidence against
- The optional Typesafe judge reads project memory messages and candidate tags for its request.
- The judge can read a key from the fixed path /home/admin_3alab/.config/typesafe/api_key when enabled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
35 flaggedbuild/migrations/023_librarian_gate.jsView file
9195patternName = private_key_rsa
severity = critical
line = 9195
Critical
Critical Secret
Package contains a critical-looking secret pattern.
build/migrations/023_librarian_gate.jsView on unpkg · L91959195patternName = private_key_rsa
severity = critical
line = 9195
Critical
Secret Pattern
RSA private key in build/migrations/023_librarian_gate.js
build/migrations/023_librarian_gate.jsView on unpkg · L919512898var { readFile } = __require("fs");
L12899: var { execFile, spawn } = __require("child_process");
L12900: var { isParsedKey, parseKey } = require_keyParser();
High
Child Process
Package source references child process execution.
build/migrations/023_librarian_gate.jsView on unpkg · L12898Findings
31 Critical3 High3 Medium6 Low
CriticalCritical Secretbuild/migrations/023_librarian_gate.js
CriticalRemote Asset Decode Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
CriticalSecret Patternbuild/migrations/023_librarian_gate.js
CriticalSecret Patternbuild/migrations/025_project_tag_alias_suggestions.js
CriticalSecret Patternbuild/migrations/014_drop_legacy_facts_constraints.js
CriticalSecret Patternbuild/migrations/008_schema_realignment.js
CriticalSecret Patternbuild/migrations/032_project_hint_venues.js
CriticalSecret Patternbuild/migrations/015_agent_provenance.js
CriticalSecret Patternbuild/migrations/028_raw_message.js
Affected versions and remediation
This report applies to mcp-agents-memory@0.9.30.
See all versions of mcp-agents-memory for other recorded verdicts.
- Review the evidence and your use of mcp-agents-memory@0.9.30 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.