mcp-agents-memory@0.9.31
Long-term memory for AI agents with provenance tracking
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has an optional, undocumented path that sends memory message content to a fixed external service for tag judging. Its explicit environment-variable gate and apparent feature purpose reduce the risk, but the data flow merits a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A message is tagged while `JEV_ENABLED=true`, and it does not propose a new tag.
Impact
Messages processed by this optional feature are disclosed to the Typesafe service; the fixed endpoint and undocumented data flow warrant user awareness.
Mechanism
The code loads a Typesafe API key from the environment or a fixed local path, then sends the message and agent metadata in an authenticated POST request.
AI rationale
The package has an optional, undocumented path that sends memory message content to a fixed external service for tag judging. Its explicit environment-variable gate and apparent feature purpose reduce the risk, but the data flow merits a warning.
Evidence
build/index.js/home/admin_3alab/.config/typesafe/api_key
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The remote judge runs only when `JEV_ENABLED` is exactly `true`.
- It reads `TYPESAFE_API_KEY` or falls back to `/home/admin_3alab/.config/typesafe/api_key`.
- The request body includes the memory message, role, agent platform, and model.
- The code posts the request with a Bearer key to `https://api.typesafe.ai/v1/systemone`.
- The tagger calls this judge for messages that do not propose a new tag.
Evidence against
- The remote judging path is explicitly gated by an environment variable and is not enabled by default.
- The request uses a Typesafe key for the Typesafe endpoint and serves the package’s tag-classification function.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
35 flaggedbuild/migrations/023_librarian_gate.jsView file
9195patternName = private_key_rsa
severity = critical
line = 9195
Critical
Critical Secret
Package contains a critical-looking secret pattern.
build/migrations/023_librarian_gate.jsView on unpkg · L91959195patternName = private_key_rsa
severity = critical
line = 9195
Critical
Secret Pattern
RSA private key in build/migrations/023_librarian_gate.js
build/migrations/023_librarian_gate.jsView on unpkg · L919512898var { readFile } = __require("fs");
L12899: var { execFile, spawn } = __require("child_process");
L12900: var { isParsedKey, parseKey } = require_keyParser();
High
Child Process
Package source references child process execution.
build/migrations/023_librarian_gate.jsView on unpkg · L12898Findings
31 Critical3 High3 Medium6 Low
CriticalCritical Secretbuild/migrations/023_librarian_gate.js
CriticalRemote Asset Decode Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
CriticalSecret Patternbuild/migrations/023_librarian_gate.js
CriticalSecret Patternbuild/migrations/025_project_tag_alias_suggestions.js
CriticalSecret Patternbuild/migrations/014_drop_legacy_facts_constraints.js
CriticalSecret Patternbuild/migrations/008_schema_realignment.js
CriticalSecret Patternbuild/migrations/032_project_hint_venues.js
CriticalSecret Patternbuild/migrations/015_agent_provenance.js
CriticalSecret Patternbuild/migrations/028_raw_message.js
Affected versions and remediation
This report applies to mcp-agents-memory@0.9.31.
See all versions of mcp-agents-memory for other recorded verdicts.
- Review the evidence and your use of mcp-agents-memory@0.9.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.