rally-project-brain-mcp@0.1.9
MCP server exposing Rally Project Brain to any MCP-compatible agent (Claude Code, Cursor, Copilot agent mode, Windsurf, ...)
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe package performs broad AI-agent configuration and hook setup only after an explicit user command, so it does not meet the install-time blocking threshold. The resulting capability can affect future agent behavior and activity reporting.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the package login command.
Impact
Future agent sessions can be connected to Rally and their activity can be reported through that integration.
Mechanism
The command writes MCP configuration, Claude hooks, and agent instruction files.
AI rationale
The package performs broad AI-agent configuration and hook setup only after an explicit user command, so it does not meet the install-time blocking threshold. The resulting capability can affect future agent behavior and activity reporting.
Evidence
index.mjs.claude/settings.jsonCLAUDE.mdAGENTS.mdGEMINI.md.cursorrules.windsurfrules~/.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes a command-line entry point and contains no install lifecycle script.
- The configuration changes run only when the user explicitly invokes the login command.
- That command installs Claude Code hooks and writes instruction files that direct agents to report session and tool activity.
- It also adds an MCP server entry to the user's Codex configuration.
Evidence against
- No automatic npm install hook was found.
- The token is requested interactively and sent to the configured Rally backend for authentication.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourceindex.mjsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
use.mjs" }] }],
sessionend: [{ hooks: [{ type: "command", command: "node .claude/hooks/session-end.mjs" }] }],
};
await writefile(settingspath, `${json.stringify(settings, null, 2)}\n`);
} catch (err) {
console.warn(`warning: couldn't set up claude code hooks (${err.message}) — skipping.`);
}
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
index.mjsView on unpkg17L18: // Embedded Claude Code hook file contents, base64-encoded to avoid any
L19: // escaping hazard from the hooks' own template-literal syntax. Generated
...
L63: async function runLoginAgent() {
L64: const backendUrl = process.env.RALLY_BACKEND_URL || "https://rally-backend.fly.dev";
L65: const rl = createInterface({ input: process.stdin, output: process.stdout });
L66: let token;
...
L87:
L88: const outPath = path.join(process.cwd(), ".mcp.json");
L89:
...
L250: // Cursor/Gemini/Windsurf, just a deeper OS-specific path. Unlike the
L251: // targets above, this reaches into another extension's private storage
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
index.mjsView on unpkg · L17Findings
3 High5 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationindex.mjs
HighBase64 Obscured Urlindex.mjs
HighSemantic Analysis Limitedindex.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.mjs
MediumAi Review Evidenceindex.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to rally-project-brain-mcp@0.1.9.
See all versions of rally-project-brain-mcp for other recorded verdicts.
- Review the evidence and your use of rally-project-brain-mcp@0.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.