monomind@2.11.10
Open-source CLI extension for Claude Code and Antigravity (agy). Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. Apache 2.0 licensed, runs locally, no data leaves your machine.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe scanner’s lifecycle and dynamic-require matches correspond to a narrowly targeted cleanup hook and a CLI shim that resolves and imports its declared dependency. The inspected source does not establish a concrete attack surface.
Decision evidence
public snapshot- The postinstall hook searches `node_modules` for `._*` files and attempts to delete them on non-Windows systems.
- The package declares `@monoes/monomindcli` version 2.11.10 as its runtime dependency.
- The CLI entrypoint locates that dependency’s bin file using Node’s module search paths, then imports the located file.
- The README describes `monomind` as an umbrella shim and says its install hook does not download code.
- The postinstall hook recursively searches `node_modules`, so matching files in that tree can be removed during installation.
Source & flagged code
9 flagged · loading sourceInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook searches `node_modules` for `._*` files and attempts to delete them on non-Windows systems.
package.jsonView on unpkg · L83Findings
Affected versions and remediation
This report applies to monomind@2.11.10.
See all versions of monomind for other recorded verdicts.
- Review the evidence and your use of monomind@2.11.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.