registry / port-authority-agent-terminal-mcp / 0.4.1

port-authority-agent-terminal-mcp@0.4.1

Cross-platform (Windows + macOS) lane coordinator for AI coding agents (Claude, Codex, etc.) — keeps multiple local agents from colliding on dev-server ports, Chrome debug ports, and Chrome user profiles. Includes a CLI, an MCP server, and a native Tauri

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The package automatically mutates agent configuration during postinstall to enable its own MCP server. This is a concrete first-party agent integration capability, but the inspected code does not establish a broader hijack or other attack behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

An eligible global or package-root npm install runs the postinstall hook, unless the MCP setup skip variable is set.

Impact

The agent can launch this package’s MCP server after installation; the automatic configuration change occurs without a separate setup command.

Mechanism

The hook invokes the package’s MCP installer, which writes its own named server entry to Claude or Codex configuration.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsdist/src/cli/install-mcp.js~/.codex/config.tomlClaude Desktop MCP configuration

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines an npm postinstall hook that loads scripts/postinstall.cjs.
The hook skips transitive installs and can be disabled with PAAT_SKIP_INSTALL_MCP=1, but eligible installs run the MCP installer automatically.
The installer targets this product’s MCP configuration entry and writes it to the existing configuration.
The requested Codex configuration location is ~/.codex/config.toml.

Evidence against

The integration registers the package’s own MCP server name and command, rather than changing unrelated agent settings.
The installer backs up existing configuration and preserves other MCP entries.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('./scripts/postinstall.cjs')}catch(e){if(e&&e.code==='MODULE_NOT_FOUND'&&String(e.message).includes('scripts/postinstall.cjs')){console.warn('[paat postinstall...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/core/pagejs.jsView file

18// new Function only PARSES here — nothing is executed. L19: new Function(`return (${expr});`); L20: return expr;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/pagejs.jsView on unpkg · L18

scripts/build-dashboard-tauri.cjsView file

31L32: const { spawnSync } = require("node:child_process"); L33: const path = require("node:path"); ... L36: L37: const repoRoot = path.resolve(__dirname, ".."); L38: const guiDir = path.join(repoRoot, "gui"); ... L43: L44: function log(msg) { process.stdout.write(`[build-dashboard] ${msg}\n`); } L45: function warn(msg) { process.stderr.write(`[build-dashboard] ${msg}\n`); } ... L48: * doesn't auto-append .cmd on Windows when shell:false, so we have to. */ L49: function npmCmd() { return process.platform === "win32" ? "npm.cmd" : "npm"; } L50: function cargoCmd() { return process.platform === "win32" ? "cargo.exe" : "cargo"; }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/build-dashboard-tauri.cjsView on unpkg · L31

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.3 matchedPath = scripts/build-dashboard-tauri.cjs matchedIdentity = npm:[redacted]:0.4.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-dashboard-tauri.cjsView on unpkg

bin/paat-dashboard.exeView file

•path = bin/paat-dashboard.exe kind = native_binary sizeBytes = 9761280 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/paat-dashboard.exeView on unpkg

dist/src/cli/install-mcp.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/cli/install-mcp.js#virtual:normalized:round1View on unpkg

dist/src/cli/install-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.3 matchedPath = dist/src/cli/install-mcp.js matchedIdentity = npm:[redacted]:0.4.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/install-mcp.jsView on unpkg

scripts/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.3 matchedPath = scripts/postinstall.cjs matchedIdentity = npm:[redacted]:0.4.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.cjsView on unpkg

dist/src/cli/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.3 matchedPath = dist/src/cli/autostart.js matchedIdentity = npm:[redacted]:0.4.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/autostart.jsView on unpkg

dist/src/cli/shortcut.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.3 matchedPath = dist/src/cli/shortcut.js matchedIdentity = npm:[redacted]:0.4.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/shortcut.jsView on unpkg

dist/src/dashboard/launch.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.4.3 matchedPath = dist/src/dashboard/launch.js matchedIdentity = npm:[redacted]:0.4.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/dashboard/launch.jsView on unpkg

dist/src/core/firefox.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = port-authority-agent-terminal-mcp@0.3.6 matchedIdentity = npm:[redacted]:0.3.6 similarity = 0.636 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/core/firefox.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/core/pagejs.jsView file

18// new Function only PARSES here — nothing is executed. L19: new Function(`return (${expr});`); L20: return expr;

Low

Findings

2 Critical9 High4 Medium6 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltadist/src/core/firefox.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityscripts/build-dashboard-tauri.cjs

HighSemantic Analysis Limiteddist/src/cli/install-mcp.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/src/cli/install-mcp.js

HighKnown Malware Source Similarityscripts/build-dashboard-tauri.cjs

HighKnown Malware Source Similarityscripts/postinstall.cjs

HighKnown Malware Source Similaritydist/src/cli/autostart.js

HighKnown Malware Source Similaritydist/src/cli/shortcut.js

Affected versions and remediation

This report applies to port-authority-agent-terminal-mcp@0.4.1.

See all versions of port-authority-agent-terminal-mcp for other recorded verdicts.

Review the evidence and your use of port-authority-agent-terminal-mcp@0.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 23:03:49.999Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code