registry / mcp-coordinator / 1.0.0

mcp-coordinator@1.0.0

Embedded MQTT broker + MCP server for multi-agent coordination

AI Security Review

scanned 21h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs mcp-coordinator init with --write-mcp-config and/or --write-claude-md.

Impact

Adds the package's coordinator endpoint and coordination guidance to selected client files.

Mechanism

Explicit MCP configuration and agent-instruction injection.

Rationale

No concrete malicious chain, stealth persistence, remote payload execution, or unauthorized exfiltration was found. Warn only for the explicit user-command mutation of MCP and CLAUDE.md control surfaces.

Evidence

package.jsondist/src/index.jsdist/cli/init.jsdist/cli/uninstall.jsdist/src/quota/credential-reader.jsdist/src/quota/quota.js<user-selected-directory>/.mcp.json<user-selected-directory>/CLAUDE.md~/.mcp-coordinator/config.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence with false-positive risk.

mcp-coordinator@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code