registry / mcp-coordinator / 1.0.1

mcp-coordinator@1.0.1

Embedded MQTT broker + MCP server for multi-agent coordination

AI Security Review

scanned 21h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs mcp-coordinator init with --write-mcp-config and/or --write-claude-md; optional doctor Phase 2 invocation.

Impact

A user-selected project can be configured to use the coordinator MCP server and receive its coordination instructions.

Mechanism

Explicit agent configuration mutation and opt-in OAuth diagnostics

Rationale

Source inspection confirms explicit, user-invoked agent configuration mutation but no covert lifecycle hook, persistence, payload execution, or exfiltration chain. Warn for the declared agent-control capability; do not block as malicious.

Evidence

package.jsondist/cli/init.jsdist/cli/uninstall.jsdist/cli/doctor.jsdist/src/index.jsdist/cli/dashboard.jsdist/cli/server/start.js.mcp.jsonCLAUDE.md~/.mcp-coordinator/config.json~/.mcp-coordinator/

Network endpoints2

localhost:<port>/mcp/login/oauth/access_token

mcp-coordinator@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code