registry / reevesagents / 1.5.0

reevesagents@1.5.0

Local tmux-first workspace manager for AI CLI agents

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs reevesagents setup --attach or reevesagents attach.

Impact

A user who opts in grants the MCP server ability to launch and steer local supported agent CLIs.

Mechanism

user-invoked AI CLI MCP registration and local agent orchestration

Rationale

Source inspection found explicit, package-aligned agent orchestration and user-scoped MCP setup, not covert installation-time or exfiltration behavior. Per policy, explicit AI-agent configuration mutation warrants a warning rather than a block.

Evidence

package.jsondist/cli.jsdist/chunk-LKJSQLX2.jsdist/server-TUKVM6PW.jsdist/server-BNCUJ4YU.js

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with false-positive risk.

reevesagents@1.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code