registry / mcp-efficiency-engine / 0.1.5

mcp-efficiency-engine@0.1.5

Motor de orquestacion para agentes MCP con routing por dominio y bootstrap portable.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Automatic npm postinstall mutates the consuming project's AI-agent configuration surface. It drops `.vscode/mcp.json` and `AGENTS.md`, then configures a repository post-commit hook when applicable.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of `mcp-efficiency-engine@0.1.5`

Impact

Can cause an AI-enabled editor to discover package-selected MCP servers and changes future repository commit behavior.

Mechanism

postinstall scaffolding of foreign MCP instructions and Git hook configuration

Policy narrative

On npm install, `postinstall` runs `bin/install-host.js` against `INIT_CWD` or the current directory. Before any explicit user CLI command, it copies package-controlled `.vscode/mcp.json` and `AGENTS.md` into the consuming project and, for a Git repository, sets its local hooks path to package-provided `.githooks`. This is an unconsented install-time mutation of a foreign AI-agent control surface, regardless of the package's stated onboarding purpose.

Rationale

Source inspection confirms a concrete automatic postinstall control-surface write into the host project. This meets the firewall block policy for unconsented npm lifecycle mutation of foreign/broad AI-agent configuration.

Evidence

package.jsonbin/install-host.js.vscode/mcp.jsonscripts/setup/install-project-hooks.ps1.githooks/post-commitAGENTS.md

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `postinstall` automatically.
`bin/install-host.js` targets `INIT_CWD` or `process.cwd()`, i.e. the consuming project.
Postinstall copies package `.vscode/mcp.json` and `AGENTS.md` into that project.
`.vscode/mcp.json` registers six package-selected MCP server commands.
Postinstall invokes `scripts/setup/install-project-hooks.ps1`, which sets local `core.hooksPath=.githooks`.
Existing differing files are preserved unless `--force`, but absent control files are created without consent.

Evidence against

No credential harvesting or exfiltration was found in inspected lifecycle files.
The lifecycle path skips interactive bootstrap when stdin is non-TTY.
The dropped MCP configuration uses local command names rather than embedded remote URLs.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 14.1 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 27-67json

27 "observability/logs.schema.md",

28 "observability/metrics.md",

29 "observability/routing-evaluator.md",

30 "observability/scoring-rubric.md",

31 "optimization/",

32 "policies/",

33 "specs/",

34 "memory/",

35 "context/repomix/repomix.config.json",

36 ".github/",

37 ".vscode/mcp.json",

38 "AGENTS.md",

39 "ARCHITECTURE.md",

40 "FINAL_USAGE_GUIDE.md",

41 "README.md",

42 "README_WIKI.md",

43 "LICENSE",

44 "requirements.txt"

45 ],

46 "scripts": {

47 "postinstall": "node ./bin/install-host.js --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "install:host": "node ./bin/install-host.js",

49 "bootstrap": "node ./bin/mcpee.js bootstrap",

50 "validate": "node ./bin/mcpee.js validate",

51 "hi": "node ./bin/mcpee.js hi",

52 "bye": "node ./bin/mcpee.js bye",

53 "intake": "node ./bin/mcpee.js intake",

54 "langsmith:kpis": "py -3 ./scripts/ops/trace-command.py --operation mcpee.langsmith-kpis --session-id mcpee-cli --cwd . -- py -3 ./scripts/ops/publish-langsmith-kpis.py",

55 "pack:check": "npm pack --dry-run"

56 },

57 "engines": {

58 "node": ">=18"

59 },

60 "keywords": [

61 "mcp",

62 "agents",

63 "routing",

64 "codegraph",

65 "gitnexus",

66 "bootstrap",

67 "autodocs",

bin/install-host.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/install-host.jsView on unpkg · L1

3const fs = require("node:fs");

4const path = require("node:path");

5const { spawnSync } = require("node:child_process");

7const packageRoot = path.resolve(__dirname, "..");

8const scaffoldEntries = [

9 ".githooks",

10 ".github",

11 ".vscode",

12 "autodocs/README.md",

13 "autodocs/schema",

14 "autolearning",

15 "context/repomix/repomix.config.json",

16 "memory",

17 "observability",

18 "optimization",

19 "orchestrator",

20 "policies",

21 "repo-intake",

scripts/context/build-repomix.ps1View file

•path = scripts/context/build-repomix.ps1 kind = build_helper sizeBytes = 64 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/context/build-repomix.ps1View on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install-host.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/install-host.js --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/install-host.jsView file

1Install-time AI-agent control hijack evidence: L27: "tooling", L28: "AGENTS.md", L29: "ARCHITECTURE.md", ... L148: function ensureDir(dirPath) { L149: fs.mkdirSync(dirPath, { recursive: true }); L150: } ... L163: L164: fs.copyFileSync(sourcePath, targetPath); L165: return { copied: true, skipped: false, reason: "copied" }; Payload evidence from AGENTS.md: L1:  L2:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/install-host.jsView on unpkg · L1

scripts/context/build-repomix.ps1View file

•path = scripts/context/build-repomix.ps1 kind = build_helper sizeBytes = 64 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/context/build-repomix.ps1View on unpkg

Findings

1 Critical1 High4 Medium2 Low

CriticalAi Agent Control Hijackbin/install-host.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperscripts/context/build-repomix.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

4 flagged

package.jsonView file

Lines 27-67json

27 "observability/logs.schema.md",

28 "observability/metrics.md",

29 "observability/routing-evaluator.md",

30 "observability/scoring-rubric.md",

31 "optimization/",

32 "policies/",

33 "specs/",

34 "memory/",

35 "context/repomix/repomix.config.json",

36 ".github/",

37 ".vscode/mcp.json",

38 "AGENTS.md",

39 "ARCHITECTURE.md",

40 "FINAL_USAGE_GUIDE.md",

41 "README.md",

42 "README_WIKI.md",

43 "LICENSE",

44 "requirements.txt"

45 ],

46 "scripts": {

47 "postinstall": "node ./bin/install-host.js --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "install:host": "node ./bin/install-host.js",

49 "bootstrap": "node ./bin/mcpee.js bootstrap",

50 "validate": "node ./bin/mcpee.js validate",

51 "hi": "node ./bin/mcpee.js hi",

52 "bye": "node ./bin/mcpee.js bye",

53 "intake": "node ./bin/mcpee.js intake",

54 "langsmith:kpis": "py -3 ./scripts/ops/trace-command.py --operation mcpee.langsmith-kpis --session-id mcpee-cli --cwd . -- py -3 ./scripts/ops/publish-langsmith-kpis.py",

55 "pack:check": "npm pack --dry-run"

56 },

57 "engines": {

58 "node": ">=18"

59 },

60 "keywords": [

61 "mcp",

62 "agents",

63 "routing",

64 "codegraph",

65 "gitnexus",

66 "bootstrap",

67 "autodocs",

bin/install-host.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/install-host.jsView on unpkg · L1

3const fs = require("node:fs");

4const path = require("node:path");

5const { spawnSync } = require("node:child_process");

7const packageRoot = path.resolve(__dirname, "..");

8const scaffoldEntries = [

9 ".githooks",

10 ".github",

11 ".vscode",

12 "autodocs/README.md",

13 "autodocs/schema",

14 "autolearning",

15 "context/repomix/repomix.config.json",

16 "memory",

17 "observability",

18 "optimization",

19 "orchestrator",

20 "policies",

21 "repo-intake",

scripts/context/build-repomix.ps1View file

•path = scripts/context/build-repomix.ps1 kind = build_helper sizeBytes = 64 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/context/build-repomix.ps1View on unpkg