post-engineer-mcp
Post Engineer MCP Server for AI pair programming and agentic workflows
This report shows the evidence for post-engineer-mcp@1.41.0. 0 of 14 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package has a narrow, opt-in telemetry disclosure mismatch: an unknown-voice error sends the attempted value to PostHog beyond the tool-call events described in the README. This is undisclosed runtime telemetry, so it warrants a warning rather than a publish block.
Decision evidence
public snapshot- The README describes optional PostHog telemetry for mcp_tool_called events.
- An unknown-voice error also emits a server_warning event containing the tool name and the attempted voice value.
- Analytics events are captured with the fixed distinct ID post-engineer-mcp.
- PostHog telemetry is disabled unless POSTHOG_API_KEY is set.
- The attempted voice value is truncated and passed through credential-fragment redaction before capture.
- The POST_ENGINEER_API_KEY is used by the client for requests to the Post Engineer API.
Source & flagged code
2 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/analytics.jsView on unpkg · L61The README describes optional PostHog telemetry for mcp_tool_called events.
README.mdView on unpkg · L33Findings
Affected versions and remediation
This report applies to post-engineer-mcp@1.41.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of post-engineer-mcp@1.41.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.