registry / AI-agent capability abuse / rally-project-brain-mcp / 0.1.8

rally-project-brain-mcp@0.1.8

MCP server exposing Rally Project Brain to any MCP-compatible agent (Claude Code, Cursor, Copilot agent mode, Windsurf, ...)

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The package does not automatically alter systems on installation, but its explicit onboarding command broadly changes AI-agent configuration and project instructions. This warrants a warning for user-invoked agent capability abuse rather than a block.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the package with the login argument and supplies an agent token.

Impact

This is a user-invoked agent-control capability that can cause connected agents to send conversation and tool data to the configured Rally service.

Mechanism

The command writes MCP configuration, Claude hook files, and project instruction files that direct agent use and reporting.

AI rationale

Evidence

index.mjs.mcp.json.cursor/mcp.json.gemini/settings.json.codeium/windsurf/mcp_config.json.codex/config.toml.vscode/mcp.json.claude/hooks.claude/settings.jsonCLAUDE.mdAGENTS.mdGEMINI.md.cursorrules.windsurfrules

Network endpoints1

rally-backend.fly.dev

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package exposes a CLI entrypoint rather than an install lifecycle hook.
Its login command obtains an agent token and configures an MCP server.
That command installs Claude Code hook files and configuration.
It adds instructions directing agents to report conversation turns and tool parameters.

Evidence against

The configuration-changing path is gated by the explicit login command.
No npm preinstall, install, or postinstall script is declared.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 44.2 KB of source, external domains: rally-backend.fly.dev

Source & flagged code

6 flagged

index.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. use.mjs" }] }], sessionend: [{ hooks: [{ type: "command", command: "node .claude/hooks/session-end.mjs" }] }], }; await writefile(settingspath, `${json.stringify(settings, null, 2)}\n`); } catch (err) { console.warn(`warning: couldn't set up claude code hooks (${err.message}) — skipping.`); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

index.mjsView on unpkg

17L18: // Embedded Claude Code hook file contents, base64-encoded to avoid any L19: // escaping hazard from the hooks' own template-literal syntax. Generated ... L63: async function runLoginAgent() { L64: const backendUrl = process.env.RALLY_BACKEND_URL || "https://rally-backend.fly.dev"; L65: const rl = createInterface({ input: process.stdin, output: process.stdout }); L66: let token; ... L87: L88: const outPath = path.join(process.cwd(), ".mcp.json"); L89: ... L250: // Cursor/Gemini/Windsurf, just a deeper OS-specific path. Unlike the L251: // targets above, this reaches into another extension's private storage

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L17

63async function runLoginAgent() { const backendUrl = process.env.RALLY_BACKEND_URL || "https://rally-backend.fly.dev"; const rl = createInterface({ input: process.stdin, output: process.stdout }); let token; try { token = (await rl.question("Paste the agent token shown in Rally: ")).trim(); } finally { rl.close(); } if (!token) { console.error("No token provided."); process.exitCode = 1; return; } const res = await fetch(`${backendUrl}/actors/whoami`, { headers: {

Medium

Ai Review Evidence

Its login command obtains an agent token and configures an MCP server.

index.mjsView on unpkg · L63

272// Ship Claude Code's own hooks into the project — this is the // ground-truth transcript path (real tool_input straight from Claude // Code's hook payload), strictly better than the report_turn fallback // every other client is stuck with, so worth having whenever the agent // actually is Claude Code. Hooks read their config from process env, not // .mcp.json, so this also needs an env block in .claude/settings.json. try { const hooksDir = path.join(process.cwd(), ".claude", "hooks"); await mkdir(hooksDir, { recursive: true }); for (co

Medium

Ai Review Evidence

That command installs Claude Code hook files and configuration.

index.mjsView on unpkg · L272

index.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.mjs#virtual:normalized:round1View on unpkg

package.jsonView file

10"url": "git+https://github.com/neeldevsen/Rally_Backend.git", "directory": "mcp-server" }, "engines": { "node": ">=18" }, "bin": { "rally-project-brain-mcp": "index.mjs" }, "dependencies": { "@modelcontextprotocol/sdk": "^1.30.0", "smol-toml":

Medium

Suspicious Lifecycle Evidence

The package exposes a CLI entrypoint rather than an install lifecycle hook.

package.jsonView on unpkg · L10

Source & flagged code

6 flagged · loading source

index.mjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

index.mjsView on unpkg

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L17

Findings

3 High5 Medium4 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationindex.mjs

HighBase64 Obscured Urlindex.mjs

HighSemantic Analysis Limitedindex.mjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidenceindex.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to rally-project-brain-mcp@0.1.8.

See all versions of rally-project-brain-mcp for other recorded verdicts.

Review the evidence and your use of rally-project-brain-mcp@0.1.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 05:22:31.458Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.