registry / AI-agent capability abuse / rally-project-brain-mcp / 0.1.3

rally-project-brain-mcp@0.1.3

MCP server exposing Rally Project Brain to any MCP-compatible agent (Claude Code, Cursor, Copilot agent mode, Windsurf, ...)

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The explicit login flow and Rally-aligned endpoint weigh against a malicious verdict. However, the setup also modifies agent instructions to encourage future sharing of task text and activity without a per-task consent check in the source, leaving a concrete agent capability risk.

Static reason

No blocking static signals were detected.

Trigger

A user runs the package’s login command and enters a Rally token.

Impact

Task details and work summaries may be sent to the shared Rally project feed when an agent follows the added instructions.

Mechanism

Login writes MCP configuration and appends instructions to project agent files; those instructions direct agents to call Rally tools with the human’s request and work activity.

AI rationale

Evidence

index.mjs.mcp.json.cursor/mcp.json~/.codex/config.tomlCLAUDE.mdAGENTS.mdGEMINI.md.cursorrules.windsurfrules

Network endpoints1

rally-backend.fly.dev

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The command adds instructions to project agent files that direct future sessions to send the human’s request and work updates through Rally tools.
Those instructions are added during login, which also writes project and user-level MCP configuration containing the token the user entered.
The activity tool sends caller-provided summaries to the shared project feed through the configured backend.

Evidence against

The manifest declares a command entry point but no install lifecycle script; configuration changes are behind the explicit login command.
Login asks the user to enter a token and uses the configured Rally backend; the source does not show a hidden transfer to an unrelated recipient.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 21.1 KB of source, external domains: rally-backend.fly.dev

Source & flagged code

6 flagged

index.mjsView file

Lines 56-96javascript

56 token = (await rl.question("Paste the agent token shown in Rally: ")).trim();

57 } finally {

58 rl.close();

59 }

60 if (!token) {

61 console.error("No token provided.");

62 process.exitCode = 1;

63 return;

64 }

66 const res = await fetch(`${backendUrl}/actors/whoami`, {

67 headers: { Authorization: `Bearer ${token}` },

68 });

69 if (!res.ok) {

70 console.error(`Could not verify that token: ${res.status} ${await res.text()}`);

71 process.exitCode = 1;

72 return;

73 }

74 const { project_id, actor } = await res.json();

76 const outPath = path.join(process.cwd(), ".mcp.json");

78 // Reference it as `npx rally-project-brain-mcp`, not a resolved absolute

79 // path — now that the package is actually published, this is strictly

80 // better: the MCP client re-resolves it fresh each launch, so the config

Medium

Ai Review Evidence

Those instructions are added during login, which also writes project and user-level MCP configuration containing the token the user entered.

index.mjsView on unpkg · L76

81 // stays correct regardless of npx's local cache location, survives being

82 // committed to a repo, and works identically on any machine. Baking in

83 // this script's own resolved path (the old behavior) tied the config to

84 // wherever *this* invocation happened to be cached, which broke on

85 // `npm cache clean` or a different machine entirely.

86 const serverEntry = {

87 command: "npx",

88 args: ["-y", "rally-project-brain-mcp"],

89 env: {

90 RALLY_BACKEND_URL: backendUrl,

91 RALLY_PROJECT_ID: project_id,

92 RALLY_ACTOR_ID: actor.id,

93 RALLY_ACTOR_TOKEN: token,

94 },

95 };

Lines 187-263javascript

187 );

188 const codexOut = tableHeaderRe.test(codexRaw)

189 ? codexRaw.replace(tableHeaderRe, newBlock)

190 : `${codexRaw.trimEnd()}\n\n${newBlock}`

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. (v)}`) .join(", "); const newblock = `[mcp_servers.${codexkey}]\n` + `command = ${tomlstr(serverentry.command)}\n` + `args = [${serverentry.args.map(tomlstr).join(", ")}]\n` + `env = { ${enventries} }\n`; const escapedkey = codexkey.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); const tableheaderre = new regexp( `^\\[mcp_servers\\.${escapedkey}\\]\\r?\\n(?:(?!\\[)[^\\n]*\\r?\\n?)*`, "m", ); const codexou

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

index.mjsView on unpkg

package.jsonView file

Lines 1-25json

2 "name": "rally-project-brain-mcp",

3 "version": "0.1.3",

4 "description": "MCP server exposing Rally Project Brain to any MCP-compatible agent (Claude Code, Cursor, Copilot agent mode, Windsurf, ...)",

5 "main": "index.mjs",

Source & flagged code

6 flagged · loading source

index.mjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

index.mjsView on unpkg

76".mcp.json"); // Reference it as `npx rally-project-brain-mcp`, not a resolved absolute // path — now that the package is actually published, this is strictly // better: t

Medium

Ai Review Evidence

Those instructions are added during login, which also writes project and user-level MCP configuration containing the token the user entered.

index.mjsView on unpkg · L76

Findings

1 High7 Medium4 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationindex.mjs

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumAi Review Evidenceindex.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to rally-project-brain-mcp@0.1.3.

See all versions of rally-project-brain-mcp for other recorded verdicts.

Review the evidence and your use of rally-project-brain-mcp@0.1.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:22:46.375Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.