registry / mcp-efficiency-engine / 0.1.13

mcp-efficiency-engine@0.1.13

Motor de orquestacion capability-centric v2 para agentes MCP con optimizacion always-on.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the consuming project rather than only this package. It creates an MCP/AI-agent configuration and activates a Git post-commit hook in the host repository without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install executes postinstall in a non-interactive host project

Impact

Persists package-controlled AI/MCP commands and post-commit execution in the consuming repository.

Mechanism

host scaffold copy plus Git hook activation

Policy narrative

Installing the package invokes its postinstall handler. In normal npm noninteractive use, it copies its scaffold into the consumer project, including .vscode/mcp.json and .githooks, then changes the host repository’s local Git hook configuration. The installed post-commit hook subsequently invokes package-supplied refresh code, establishing an unconsented foreign AI-agent control surface and persistence mechanism.

Rationale

This meets the block boundary: an npm postinstall mutates a foreign host project’s AI/MCP configuration and activates a Git hook. Lack of a confirmed network exfiltration path does not remove that concrete install-time control-surface mutation.

Evidence

package.jsonbin/install-host.js.vscode/mcp.jsonscripts/setup/install-project-hooks.ps1.githooks/post-commitscripts/ops/post-commit-refresh.ps1.git/config

mcp-efficiency-engine@0.1.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code