registry / rally-project-brain-mcp / 0.1.2

rally-project-brain-mcp@0.1.2

MCP server exposing Rally Project Brain to any MCP-compatible agent (Claude Code, Cursor, Copilot agent mode, Windsurf, ...)

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the agent configuration changes occur in the explicit login flow after the user supplies a Rally token. The source shows package-aligned onboarding behavior and no confirmed attack surface.

Static reason

No blocking static signals were detected.

Trigger

The user runs the login command and provides an agent token.

Impact

No attack impact was identified; the changes configure the requested Rally connection and its agent guidance.

Mechanism

The setup verifies the token with Rally, writes project-scoped MCP configuration, and adds onboarding guidance to known project instruction files.

AI rationale

Evidence

.mcp.json.cursor/mcp.jsonCLAUDE.mdAGENTS.mdGEMINI.md.cursorrules.windsurfrules

Network endpoints1

rally-backend.fly.dev

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines the package entrypoints and dependencies and has no install lifecycle hook.
The flagged path is the project’s .mcp.json file; its write occurs in the agent login setup.
Login asks the user to supply an agent token and sends it to the configured Rally backend for verification.
The login setup runs only when the user invokes the login command.
The setup adds Rally onboarding guidance to project instruction files, preserving existing content when the marker is absent.

Evidence against

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 18.6 KB of source, external domains: rally-backend.fly.dev

Source & flagged code

6 flagged

index.mjsView file

Lines 29-94javascript

29 const entries = Object.entries(mcpServers ?? {});

30 const existingForActor = entries.find(

31 ([, server]) => server?.env?.RALLY_ACTOR_ID === actorId,

32 );

33 if (existingForActor) return existingForActor[0];

35 const slug = String(displayName || "agent")

36 .toLowerCase()

37 .replace(/[^a-z0-9]+/g, "-")

38 .replace(/^-+|-+$/g, "") || "agent";

39 const baseKey = `rally-project-brain-${slug}`;

40 if (!(baseKey in (mcpServers ?? {}))) return baseKey;

41 return `${baseKey}-${actorId.slice(0, 8)}`;

42}

44// `rally-project-brain-mcp login --agent` — a one-command onboarding flow:

45// paste the token shown once in Rally's "Connect Agent" modal, and this

46// resolves everything else (project, actor) via /actors/whoami and writes

47// .mcp.json itself, referencing itself as `npx rally-project-brain-mcp` —

48// no local checkout, no manual JSON editing.

49async function runLoginAgent() {

50 const backendUrl = process.env.RALLY_BACKEND_URL || "https://rally-backend.fly.dev";

51 const rl = createInterface({ input: process.stdin, output: process.stdout });

52 let token;

53 try {

54 token = (await rl.question("Paste the agent token shown in Rally: ")).trim();

55 } finally {

56 rl.close();

57 }

58 if (!token) {

59 console.error("No token provided.");

60 process.exitCode = 1;

Low

Ai Review Evidence

index.mjsView on unpkg · L49

61 return;

62 }

64 const res = await fetch(`${backendUrl}/actors/whoami`, {

65 headers: { Authorization: `Bearer ${token}` },

66 });

67 if (!res.ok) {

68 console.error(`Could not verify that token: ${res.status} ${await res.text()}`);

69 process.exitCode = 1;

70 return;

71 }

72 const { project_id, actor } = await res.json();

74 const outPath = path.join(process.cwd(), ".mcp.json");

76 // Reference it as `npx rally-project-brain-mcp`, not a resolved absolute

77 // path — now that the package is actually published, this is strictly

78 // better: the MCP client re-resolves it fresh each launch, so the config

Low

Ai Review Evidence

The flagged path is the project’s .mcp.json file; its write occurs in the agent login setup.

index.mjsView on unpkg · L74

79 // stays correct regardless of npx's local cache location, survives being

80 // committed to a repo, and works identically on any machine. Baking in

81 // this script's own resolved path (the old behavior) tied the config to

82 // wherever *this* invocation happened to be cached, which broke on

83 // `npm cache clean` or a different machine entirely.

84 const serverEntry = {

85 command: "npx",

86 args: ["-y", "rally-project-brain-mcp"],

87 env: {

88 RALLY_BACKEND_URL: backendUrl,

89 RALLY_PROJECT_ID: project_id,

90 RALLY_ACTOR_ID: actor.id,

91 RALLY_ACTOR_TOKEN: token,

92 },

93 };

Lines 167-207javascript

167 } catch (err) {

168 if (err.code !== "ENOENT") throw err;

169 }

170 if (content === null) {

171 await writeFile(filePath, `${rallySnippet

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const cursorpath = path.join(process.cwd(), ".cursor", "mcp.json"); try { let cursorexisting = {}; try { cursorexisting = json.parse(await readfile(cursorpath, "utf8")); } catch (err) { if (err.code !== "enoent") { console.warn(`warning: existing .cursor/mcp.json couldn't be parsed (${err.message}) — replacing it.`); } } const cursorkey = resolveserverkey(cursorexisting.mcpservers, actor.id, actor.display_name); cursorexisting.mcpserver

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

index.mjsView on unpkg

index.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.mjs#virtual:normalized:round1View on unpkg

package.jsonView file

Lines 1-21json

2 "name": "rally-project-brain-mcp",

3 "version": "0.1.2",

4 "description": "MCP server exposing Rally Project Brain to any MCP-compatible agent (Claude Code, Cursor, Copilot agent mode, Windsurf, ...)",

5 "main": "index.mjs",

Source & flagged code

6 flagged · loading source

index.mjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

index.mjsView on unpkg

74".mcp.json"); // Reference it as `npx rally-project-brain-mcp`, not a resolved absolute // path — now that the package is actually published, this is strictly // better: t

Low

Ai Review Evidence

The flagged path is the project’s .mcp.json file; its write occurs in the agent login setup.

index.mjsView on unpkg · L74

Findings

2 High2 Medium8 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationindex.mjs

HighSemantic Analysis Limitedindex.mjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceindex.mjs

Affected versions and remediation

This report applies to rally-project-brain-mcp@0.1.2.

See all versions of rally-project-brain-mcp for other recorded verdicts.

Review the evidence and your use of rally-project-brain-mcp@0.1.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:22:46.113Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.