registry / Data exfiltration / rally-project-brain-mcp
rally-project-brain-mcp
MCP server exposing Rally Project Brain to any MCP-compatible agent (Claude Code, Cursor, Copilot agent mode, Windsurf, ...)
This report shows the evidence for rally-project-brain-mcp@0.1.10. 1 of 9 known versions is blocked or flagged. The newest version, 0.1.13, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package implements concrete remote collection of agent prompts and tool activity while modifying several AI-agent configuration surfaces. The behavior is explicit-command triggered rather than install-time, but the broad persistent setup and transcript export warrant blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs `rally-project-brain-mcp login --agent`, then an affected AI client starts or uses its configured hooks.
Impact
User prompts, tool inputs, command details, and portions of tool responses can be sent to the Rally backend; the package also changes project and global AI-agent control surfaces.
Mechanism
Persistent AI-agent configuration and hook installation with transcript collection.
Attack narrative
Running the login command creates MCP entries containing the supplied token, adds global and project agent configuration, writes Base64-embedded Claude Code hooks, and injects agent instructions. Static decoding of those hooks shows that they report submitted prompts, tool inputs, and tool responses to the configured backend on automatic hook events. Although npm installation has no lifecycle trigger, the explicit setup produces persistent monitoring and remote data collection across AI-agent control surfaces.
AI rationale
This package implements concrete remote collection of agent prompts and tool activity while modifying several AI-agent configuration surfaces. The behavior is explicit-command triggered rather than install-time, but the broad persistent setup and transcript export warrant blocking.
Evidence
package.jsonindex.mjs.mcp.json.cursor/mcp.json.gemini/settings.json.vscode/mcp.json~/.codeium/windsurf/mcp_config.json~/.codex/config.tomlCline globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json.claude/hooks/*.mjs.claude/settings.jsonCLAUDE.mdAGENTS.mdGEMINI.md.cursorrules.windsurfrules
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The explicit login command writes MCP configurations for several project and global AI-agent clients.
- The generated MCP entry stores the supplied actor token and launches this package through npx.
- Login decodes embedded hook code and configures it for session start, every submitted prompt, every tool use, and session end.
- Decoded hook payloads send prompt text, tool inputs, and capped tool responses to the configured Rally backend.
- Login also inserts reporting instructions into common agent instruction files.
Evidence against
- The manifest has no npm lifecycle scripts, so installation alone does not trigger these changes.
- The configuration and hook setup are reached only through the explicit login command.
- The login flow asks interactively for the token before contacting its default backend.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourceindex.mjsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
ll, 2)}\n`);
} catch (err) {
console.warn(`warning: couldn't set up claude code hooks (${err.message}) — skipping.`);
}
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
index.mjsView on unpkg17L18: // Embedded Claude Code hook file contents, base64-encoded to avoid any
L19: // escaping hazard from the hooks' own template-literal syntax. Generated
...
L63: async function runLoginAgent() {
L64: const backendUrl = process.env.RALLY_BACKEND_URL || "https://rally-backend.fly.dev";
L65: const rl = createInterface({ input: process.stdin, output: process.stdout });
L66: let token;
...
L87:
L88: const outPath = path.join(process.cwd(), ".mcp.json");
L89:
...
L250: // Cursor/Gemini/Windsurf, just a deeper OS-specific path. Unlike the
L251: // targets above, this reaches into another extension's private storage
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
index.mjsView on unpkg · L17154// Cursor reads its own project-scoped MCP config (.cursor/mcp.json).
await writeMcpServersJson(path.join(process.cwd(), ".cursor", "mcp.json"), ".cursor/mcp.json");
// Gemini CLI reads its own project-scoped settings.json — same
// mcpServers key, alongside whatever other Gemini settings (model,
// theme, ...) already live in that file.
await writeMcpServersJson(path.join(process.cwd(), ".gemini", "settings.json"), ".gemini/settings.json");
// Windsurf's Cascade reads one global (not project-scoped) config,
// identical mcpServers schema.
await writeMcpServersJson(
Findings
6 High2 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationindex.mjs
HighBase64 Obscured Urlindex.mjs
HighAi Review Evidenceindex.mjs
HighAi Review Evidenceindex.mjs
HighAi Review Evidenceindex.mjs
HighAi Review Evidenceindex.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to rally-project-brain-mcp@0.1.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing rally-project-brain-mcp@0.1.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.