registry / AI-agent control-surface risk / port-authority-agent-terminal-mcp

port-authority-agent-terminal-mcp

Cross-platform (Windows + macOS) lane coordinator for AI coding agents (Claude, Codex, etc.) — keeps multiple local agents from colliding on dev-server ports, Chrome debug ports, and Chrome user profiles. Includes a CLI, an MCP server, and a native Tauri

This report shows the evidence for port-authority-agent-terminal-mcp@0.4.3. 3 of 9 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The confirmed automatic postinstall chain mutates Claude and Codex MCP configuration, a foreign AI-agent control surface, and adds Windows login persistence. This meets the install-hook abuse blocking policy even though no external exfiltration endpoint was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during a global install or an install run from this package root.

Impact

Claude and Codex hosts can be configured to launch this package's CLI without a separate user command; Windows gains login persistence.

Mechanism

Automatic MCP configuration mutation and Windows autostart setup.

Policy narrative

The package registers an automatic postinstall hook. Unless an opt-out variable is already set, it runs its MCP installer, which writes entries into Claude Desktop and Codex configuration files so those hosts execute the package CLI. The same hook enables Windows login autostart. These are unconsented install-time changes to foreign AI-agent control surfaces and user startup behavior.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsdist/src/cli/install-mcp.js%APPDATA%\Claude\claude_desktop_config.json~/.codex/config.toml

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest automatically runs a postinstall helper.
The postinstall hook invokes MCP wiring unless an environment opt-out is set.
The installer writes Claude Desktop and Codex MCP configuration entries that execute this package's CLI.
On Windows the automatic hook also enables login autostart.

Evidence against

No automatic external network endpoint or credential exfiltration was confirmed from the inspected lifecycle code.
The MCP entry launches the package's local CLI via stdio rather than downloading a remote payload.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 61 file(s), 499 KB of source, external domains: 127.0.0.1, docs.claude.com, rustup.rs

Source & flagged code

15 flagged

package.jsonView file

Lines 52-92json

52 "gui/src-tauri/tauri.conf.json",

53 "gui/src-tauri/capabilities",

54 "gui/src-tauri/icons",

55 "gui/src-tauri/src",

56 "scripts/postinstall.cjs",

57 "scripts/build-dashboard-tauri.cjs",

58 "README.md",

59 "LICENSE",

60 "CHANGELOG.md"

61 ],

62 "scripts": {

63 "build": "npm run build:icons && npm run build:dashboard && tsc -p tsconfig.json",

64 "build:server": "tsc -p tsconfig.json",

65 "build:icons": "node scripts/build-icons.mjs",

66 "build:dashboard": "node scripts/build-dashboard-tauri.cjs",

67 "build:dashboard:strict": "node scripts/build-dashboard-tauri.cjs --strict",

68 "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",

69 "dev": "tsx src/cli/index.ts",

70 "prepare": "node scripts/prepare.cjs",

71 "prepack": "node scripts/prepack.cjs",

72 "postinstall": "node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e&&e.code==='MODULE_NOT_FOUND'&&String(e.message).includes('scripts/postinstall.cjs')){console.warn('[paat postinstall] skipped missing helper: '+e.message);process.exit(0)}throw e}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L72

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L72

73 "test": "tsc -p tsconfig.json && node --test --test-reporter=spec dist/tests/*.test.js",

74 "lint": "tsc -p tsconfig.json --noEmit",

75 "chrome": "tsx scripts/chrome.ts",

76 "robust-test": "tsx scripts/robust-test.ts",

77 "robust-test:verbose": "tsx scripts/robust-test.ts --verbose",

78 "prepublishOnly": "npm run clean && npm run build"

79 },

80 "keywords": [

81 "windows",

82 "ai-agents",

83 "agent-coordination",

84 "claude",

85 "claude-desktop",

86 "codex",

87 "codex-desktop",

88 "chrome",

89 "chrome-devtools-protocol",

90 "cdp",

91 "remote-debugging",

92 "playwright",

dist/src/core/pagejs.jsView file

Lines 1-38javascript

1/**

2 * In-page JavaScript snippets shared by BOTH page-control drivers (BiDi for

3 * Firefox, CDP for Chrome/Edge). Every snippet is a single EXPRESSION that

4 * evaluates to a JSON string, so both protocols get back `{type:"string"}`

5 * and the driver just JSON.parses it — identical semantics in every browser.

6 *

7 * All user-supplied fragments (selectors, values, expressions) are embedded

8 * via JSON.stringify so quotes/backslashes/newlines can never break out of

9 * the generated code.

10 */

scripts/build-dashboard-tauri.cjsView file

Lines 11-51javascript

11 * we don't want .msi/.dmg installers — npm is the install mechanism.

12 * 4. Copy the produced binary to bin/<binary-name> so the npm package can

13 * ship it. Naming:

bin/paat-dashboard.exeView file

•path = bin/paat-dashboard.exe kind = native_binary sizeBytes = 9761792 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/paat-dashboard.exeView on unpkg

dist/src/cli/install-mcp.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/cli/install-mcp.js#virtual:normalized:round1View on unpkg

dist/src/cli/install-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.2 matchedPath = dist/src/cli/install-mcp.js matchedIdentity = npm:[redacted]:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/install-mcp.jsView on unpkg

dist/src/core/chrome.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = port-authority-agent-terminal-mcp@0.3.6 matchedIdentity = npm:[redacted]:0.3.6 similarity = 0.568 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/core/chrome.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.2 matchedPath = dist/src/core/chrome.js matchedIdentity = npm:[redacted]:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/core/chrome.jsView on unpkg

dist/src/core/firefox.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.2 matchedPath = dist/src/core/firefox.js matchedIdentity = npm:[redacted]:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/core/firefox.jsView on unpkg

scripts/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.2 matchedPath = scripts/postinstall.cjs matchedIdentity = npm:[redacted]:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.cjsView on unpkg

dist/src/cli/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.2 matchedPath = dist/src/cli/autostart.js matchedIdentity = npm:[redacted]:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/autostart.jsView on unpkg

dist/src/cli/shortcut.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.2 matchedPath = dist/src/cli/shortcut.js matchedIdentity = npm:[redacted]:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/shortcut.jsView on unpkg

dist/src/dashboard/launch.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.2 matchedPath = dist/src/dashboard/launch.js matchedIdentity = npm:[redacted]:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/dashboard/launch.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./scripts/postinstall.cjs')}catch(e){if(e&&e.code==='MODULE_NOT_FOUND'&&String(e.message).includes('scripts/postinstall.cjs')){console.warn('[paat postinstall...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/core/pagejs.jsView file

18// new Function only PARSES here — nothing is executed. L19: new Function(`return (${expr});`); L20: return expr;

Low

Findings

2 Critical11 High4 Medium6 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltadist/src/core/chrome.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityscripts/build-dashboard-tauri.cjs

HighSemantic Analysis Limiteddist/src/cli/install-mcp.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/src/cli/install-mcp.js

HighKnown Malware Source Similaritydist/src/core/chrome.js

HighKnown Malware Source Similaritydist/src/core/firefox.js

HighKnown Malware Source Similarityscripts/build-dashboard-tauri.cjs

HighKnown Malware Source Similarityscripts/postinstall.cjs

Affected versions and remediation

This report applies to port-authority-agent-terminal-mcp@0.4.3.

The versions list below shows the verdict for each recorded version.

Avoid installing port-authority-agent-terminal-mcp@0.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-05 08:44:04.215Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

0.4.3latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 5, 2026, 8:29 AM 0.4.2MaliciousInstall Hook AbuseBlockPublishedSep 5, 2026, 2:54 AM 0.4.1SuspiciousAgent extension lifecycle riskWarnPublishedSep 3, 2026, 2:52 AM 0.3.16Suspicious—Warn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages