registry / overmind-mcp / 3.7.1

overmind-mcp@3.7.1

⚠ Under review

Orchestrateur universel agents IA multi-modeles via MCP. Inclut le protocole 'Custom-Nickname' pour identifier vos agents avec des surnoms originaux (The Chaos Prophet, Shadow Sniper, etc.), l'isolation mémoire (Private Memory Context) et le support pour

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 21 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 92 file(s), 895 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.minimax.com, api.minimaxi.com, api.telegram.org, api.z.ai, deamondev888.github.io, discord.gg, docs.docker.com, github.com, openrouter.ai, podman.io, raw.githubusercontent.com, www.docker.com, www.npmjs.com, www.trae.ai, www.w3.org

Source & flagged code

13 flagged

package.jsonView file

Lines 36-76json

36 "bin",

37 ".mcp.json.example"

38 ],

39 "scripts": {

40 "build": "tsc",

41 "rebuild": "rimraf dist && tsc",

42 "clean": "rimraf dist",

43 "start": "node --max-old-space-size=256 --no-warnings --env-file=.env dist/bin/cli.js",

44 "dev": "node --max-old-space-size=256 --no-warnings --watch --env-file=.env dist/bin/cli.js",

45 "build:fix": "pnpm run clean && pnpm install && pnpm run build",

46 "lint": "eslint .",

47 "lint:fix": "eslint . --fix",

48 "format": "prettier --write .",

49 "check-types": "tsc --noEmit",

50 "test": "vitest run",

51 "test:install": "node scripts/test-installation.mjs",

52 "changeset": "changeset",

53 "version": "changeset version && node scripts/auto-changelog.mjs",

54 "release": "pnpm run build && changeset publish",

55 "prepublishOnly": "pnpm run rebuild",

56 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "setup": "overmind-setup",

58 "setup:deps": "node scripts/install-dependencies.mjs",

59 "postgres:up": "overmind-postgres-mcp up",

60 "postgres:down": "overmind-postgres-mcp down",

61 "postgres:status": "overmind-postgres-mcp status",

62 "postgres:logs": "overmind-postgres-mcp logs",

63 "postgres:reset": "overmind-postgres-mcp reset",

64 "prebuild": "node -e \"try{require('fs').mkdirSync('dist/bin',{recursive:true});require('fs').copyFileSync('bin/launch.cjs','dist/bin/launch.cjs');console.log('Copied launch.cjs')}catch{console.log('dist/bin not ready yet')}\""

65 },

66 "keywords": [

67 "mcp",

68 "model-context-protocol",

69 "claude-code",

70 "ai-agent",

71 "llm",

72 "orchestration",

73 "automation",

74 "pgvector",

75 "docker",

76 "auto-installation"

bin/launch.cjsView file

Lines 1-24javascript

1process.title = "MCP-OVERMIND"; // [V16] Window identification

2// launch.js — compiled launcher for Workflow

3// Prebuild copies this to dist/bin/launch.js

5const { exec, spawn } = require("child_process");

6const

dist/lib/InstallHelper.jsView file

Lines 1-22javascript

1import { exec } from 'child_process';

2import { promisify } from 'util';

3const execAsync = promisify(exec);

4export const

scripts/postinstall.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * ═══════════════════════════════════════════════════════════════════════════════

4 * OVERMIND-MCP - POST-INSTALL AUTOMATIQUE (SIMPLIFIÉ)

5 * ═══════════════════════════════════════════════════════════════════════════════

6 * Script exécuté automatiquement après npm install -g overmind-mcp

7 * INSTALLE UNIQUEMENT :

8 * - Vérifie Docker

9 * - Installe PostgreSQL + pgvector (si absent)

10 * - Copie .env.example → .env

scripts/setup-windows.jsView file

Lines 35-75javascript

35 } catch (error) {

36 console.error(`❌ Erreur: ${error.message}`);

37 return false;

38 }

39}

41function

bin/test_mcp.batView file

•path = bin/test_mcp.bat kind = build_helper sizeBytes = 170 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test_mcp.batView on unpkg

dist/services/KiloRunner.jsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = dist/services/KiloRunner.js matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/KiloRunner.jsView on unpkg

scripts/test-installation.mjsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = scripts/test-installation.mjs matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-installation.mjsView on unpkg

dist/services/ClineRunner.jsView file

•matchType = normalized_sha256 matchedPackage = overmind-mcp@3.2.6 matchedPath = dist/services/ClineRunner.js matchedIdentity = npm:b3Zlcm1pbmQtbWNw:3.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/ClineRunner.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code