md-redline@0.9.0
Inline review comments for markdown specs. Built-in MCP server hands feedback directly to your AI agent.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious under the install-control-surface policy because configuration mutation is explicitly user-invoked and there is no registry-install lifecycle hook. The embedded agent-control instructions and user-scope MCP registration warrant a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user runs mdr mcp install or configures and invokes the MCP server.
Impact
A connected AI agent may be steered to defer reporting and repeatedly invoke the package review tool.
Mechanism
Explicit MCP registration and agent-directed review workflow.
AI rationale
This is not malicious under the install-control-surface policy because configuration mutation is explicitly user-invoked and there is no registry-install lifecycle hook. The embedded agent-control instructions and user-scope MCP registration warrant a warning.
Evidence
package.jsonbin/cli.jsdist/mcp-stdio.jsdist/server.jsclaude_desktop_config.json.md-redline.json
Network endpoints2
registry.npmjs.org127.0.0.1:${port}
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit mcp install command adds an md-redline server entry to Claude Desktop configuration.
- The MCP payload instructs an AI agent not to report to the user and to keep calling the package tool until it returns done.
- The server checks npm for updates and stores update state in its preferences.
Evidence against
- The manifest has no preinstall, install, or postinstall hook; prepublishOnly only builds for publishing.
- Claude configuration changes require the explicit mdr mcp install command.
- Observed service calls are localhost APIs plus the npm registry update check; no credential collection or secret exfiltration was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedbin/cli.jsView file
36const APP_DIR = resolve(__dirname, '..');
L37: const require = createRequire(import.meta.url);
L38: const { version: CLI_VERSION } = require(join(APP_DIR, 'package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L36dist/assets/chunk-K5T4RW27-C38NE-jm.jsView file
76contains invisible/control Unicode U+200B (zero width space)
`&&r++}n&&t.length>0&&e.push(t.length),this._lineOffsets=e}return this._lineOffsets}positionAt(e){e=Math.max(Math.min(e,this._content.length),0);let t=this.getLineOffsets(),n=0,r=t.length;if(r===0)return q.create(0,e);for(;n<r;){let i=Math.
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/assets/chunk-K5T4RW27-C38NE-jm.jsView on unpkg · L76dist/assets/chunk-OYMX7WX6-BjfDaoEb.jsView file
Findings
1 Critical5 High4 Medium5 Low
CriticalTrojan Source Unicodedist/assets/chunk-K5T4RW27-C38NE-jm.js
HighKnown Malware Source Similaritydist/assets/chunk-OYMX7WX6-BjfDaoEb.js
HighKnown Malware Source Similaritydist/assets/diagram-G4DWMVQ6-C7GHEXy3.js
HighKnown Malware Source Similaritydist/assets/flowDiagram-DWJPFMVM-D_HoV_BB.js
HighKnown Malware Source Similaritydist/assets/wardleyDiagram-NUSXRM2D-CUKCOE-9.js
HighPrevious Version Dangerous Deltadist/server.js
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to md-redline@0.9.0.
See all versions of md-redline for other recorded verdicts.
- Review the evidence and your use of md-redline@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.