post-engineer-mcp@1.40.0
Post Engineer MCP Server for AI pair programming and agentic workflows
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s ordinary tool analytics are limited to tool names and require a PostHog key, but voice validation also sends user-supplied input in a warning event, beyond the stated analytics scope. This is undisclosed excess runtime telemetry, so the package is suspicious.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes a tool with an unrecognized voice value while PostHog telemetry is enabled by POSTHOG_API_KEY.
Impact
User-supplied tool input may be collected by the analytics service beyond the documented tool-name-only event data.
Mechanism
The voice validation failure emits a server_warning event containing the truncated, partially redacted voice attempt.
AI rationale
The package’s ordinary tool analytics are limited to tool names and require a PostHog key, but voice validation also sends user-supplied input in a warning event, beyond the stated analytics scope. This is undisclosed excess runtime telemetry, so the package is suspicious.
Evidence
dist/analytics.jsdist/voice-filters.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An unknown voice attempt is included in a PostHog server_warning event after credential-fragment redaction.
- Tool-call analytics are enabled only when POSTHOG_API_KEY is set.
- The analytics wrapper is documented as sending only the tool name, so the additional voice value exceeds that description.
Evidence against
- The package’s API client sends its API key to the Post Engineer service, and the server requires that key to run.
- The server starts only when invoked as the main module; no install hook runs it.
- Most tool tracking sends the tool name, and telemetry failures are swallowed.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
2 flaggeddist/analytics.jsView file
61package = post-engineer-mcp; repositoryIdentity = post-engineer; dependency = posthog-node
L61: // wants >=20.20 — on older Node this catch degrades to disabled.
L62: const { PostHog } = await import('posthog-node');
L63: const host = process.env['POSTHOG_HOST'] ?? DEFAULT_POSTHOG_HOST;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/analytics.jsView on unpkg · L6149clientPromise = (async () => {
const apiKey = process.env['POSTHOG_API_KEY'];
if (typeof apiKey !== 'string' || apiKey.length === 0) {
if (!warned)
Medium
Ai Review Evidence
Tool-call analytics are enabled only when POSTHOG_API_KEY is set.
dist/analytics.jsView on unpkg · L49Findings
1 High4 Medium7 Low
HighCopied Package Dependency Bridgedist/analytics.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/analytics.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to post-engineer-mcp@1.40.0.
See all versions of post-engineer-mcp for other recorded verdicts.
- Review the evidence and your use of post-engineer-mcp@1.40.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.