registry / memoryrouter-codex / 1.2.1
memoryrouter-codex@1.2.1
Automatic, project-scoped MemoryRouter memory for OpenAI Codex
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source implements an explicit-user-command Codex extension with automatic capture, remote transmission, and an older self-package runtime reference. It has no npm lifecycle hook or concrete malicious install-time behavior, so it should warn rather than block.
Static reason
No blocking static signals were detected.
Trigger
The user runs memoryrouter-codex init; later Codex hook events or an explicit reflect command activate the runtime.
Impact
Conversation content may leave the machine, and project API-key mode can fetch and execute the package's older 1.1.0 release through npx.
Mechanism
Managed Codex extension setup with automatic memory capture and remote API requests.
AI rationale
The source implements an explicit-user-command Codex extension with automatic capture, remote transmission, and an older self-package runtime reference. It has no npm lifecycle hook or concrete malicious install-time behavior, so it should warn rather than block.
Evidence
package.jsonbin/cli.cjslib/installer.cjslib/managed.cjslib/hooks.cjsruntime/hook.cjsruntime/api.cjsruntime/reflect.cjs~/.codex/config.toml~/.codex/hooks.json~/.codex/AGENTS.md.codex/config.toml.codex/hooks.jsonAGENTS.md~/.memoryrouter/codex/config.json
Network endpoints2
api.memoryrouter.aimcp.memoryrouter.ai/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit init command writes Codex configuration, hooks, and AGENTS.md guidance.
- Installed hooks capture user prompts and final assistant responses, then store them remotely when a key is available.
- Requests use a bearer API key and send memory data to the MemoryRouter API.
- Project API-key configuration invokes npx for memoryrouter-codex@1.1.0, not this package version.
- The reflect command passes server-provided content to codex exec.
Evidence against
- package.json contains no preinstall, install, or postinstall hook.
- Configuration mutation requires the user to run init; it is not performed on package installation.
- The installer uses managed blocks and removes only its owned hooks on uninstall.
- No secret harvesting, arbitrary shell execution, or unrelated network endpoint was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedruntime/project.cjsView file
4const crypto = require('crypto');
L5: const { execFileSync } = require('child_process');
L6:
High
Child Process
Package source references child process execution.
runtime/project.cjsView on unpkg · L4lib/installer.cjsView file
124L125: function codexInfo(cwd, env = process.env) {
L126: try {
L127: const output = execFileSync('codex', ['--version'], { cwd, env, encoding: 'utf8', timeout: 5000 }).trim();
L128: return { installed: true, output, version: parseVersion(output) };
...
L135: try {
L136: const response = await fetch(url, { ...init, signal: controller.signal });
L137: let data = null;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/installer.cjsView on unpkg · L124•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execfilesync } = require('child_process');
const { codexhome, datahome, loadconfig, saveconfig, configpath } = require('../runtime/config.cjs');
const { resolveproject } = require('../runtime/project.cjs');
const { mcp_endpoint, integration_version } = require('../runtime/constants.cjs');
const {
installtoml, uninstalltoml, installagents, uninstallagents, readtext, replaceblock,
hasunmanagedmemoryroutertable, toml_start, toml_end, agents_start, agents_end,
} = require('./managed.cjs');
const { installhooks, uninstallhooks, isownedhook, managedgroups, parsehooks } = requir
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/installer.cjsView on unpkg64function init(options = {}) {
const layout = resolveLayout(options);
const auth = options.auth || 'oauth';
if (!['oauth', 'api-key'].includes(auth)) throw new Error('--auth must be oauth or api-key');
preflight(layout, options);
copyRuntime(layout.runtimeDir);
const results = [];
results.push(installToml(layout.configFile, { auth, scope: layout.scope, runtimeDir: layout.runtimeDir, force: options.force }));
if (options.hooks !== false) results.push(installHooks(layout.hooksFile, layout.runtimeDir, layout.scope));
if (options.agents !== false) results.push(installAgents(layout
Medium
Ai Review Evidence
The explicit init command writes Codex configuration, hooks, and AGENTS.md guidance.
lib/installer.cjsView on unpkg · L64runtime/hook.cjsView file
120const content = turnContent({ ...input, turn_id: turnId }, state);
const kind = partial ? 'checkpoint' : 'turn';
const handle = memoryHandle(context.project.handle, kind, content);
if ((state.capturedHandles || []).includes(handle)) return { ok: true, skipped: 'deduplicated', handle };
const result = await storeScoped(content, {
...context,
kind,
handle,
sessionId: `mrcodex:${context.project.handle}:${sessionId}`,
sk[redacted]: true,
timeoutMs: partial ? 10000 : 15000,
tags: ['codex', kind],
});
Medium
Ai Review Evidence
Installed hooks capture user prompts and final assistant responses, then store them remotely when a key is available.
runtime/hook.cjsView on unpkg · L120lib/managed.cjsView file
75} else if (scope === 'project') {
lines.push(
'[mcp_servers.memoryrouter]',
'command = "npx"',
`args = ["-y", "memoryrouter-codex@${INTEGRATION_VERSION}", "mcp-server"]`,
'enabled = true',
'required = false',
'startup_timeout_sec = 20',
'tool_timeout_sec = 45',
'default_tools_approval_mode = "writes"',
'',
'[mcp_servers.memoryrouter.tools.memory_forget]',
'approval_mode = "prompt"',
Medium
Ai Review Evidence
Project API-key configuration invokes npx for memoryrouter-codex@1.1.0, not this package version.
lib/managed.cjsView on unpkg · L75Findings
3 High5 Medium4 Low
HighChild Processruntime/project.cjs
HighSame File Env Network Executionlib/installer.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/installer.cjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/installer.cjs
MediumAi Review Evidenceruntime/hook.cjs
MediumAi Review Evidencelib/managed.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to memoryrouter-codex@1.2.1.
See all versions of memoryrouter-codex for other recorded verdicts.
- Review the evidence and your use of memoryrouter-codex@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.