registry / mcp-efficiency-engine / 0.1.15

mcp-efficiency-engine@0.1.15

Motor de orquestacion capability-centric v2 para agentes MCP con optimizacion always-on.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the consuming project without an explicit user command. It scaffolds VS Code MCP configuration and installs a persistent post-commit hook.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install / postinstall

Impact

Foreign project AI-agent control surface and commit lifecycle are altered; later commits execute copied scripts.

Mechanism

automatic host MCP configuration and Git-hook installation

Policy narrative

On npm installation, postinstall invokes bin/install-host.js. In its automatic noninteractive path it copies a .vscode/mcp.json into the host project and configures Git's local core.hooksPath to copied .githooks. The installed post-commit hook executes package-controlled PowerShell after subsequent commits. This is unconsented install-time mutation of a consuming project's AI-agent configuration and persistent development control surface.

Rationale

Source confirms the scanner finding: lifecycle code automatically writes host MCP configuration and enables a host Git hook. This meets the firewall block boundary regardless of the absence of unconditional network exfiltration.

Evidence

package.jsonbin/install-host.js.vscode/mcp.json.githooks/post-commitscripts/setup/install-project-hooks.ps1scripts/ops/post-commit-refresh.ps1

mcp-efficiency-engine@0.1.15

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code