registry / AI-agent control-surface risk / scrivener-mcp

scrivener-mcp

MCP server for Scrivener - Read, write, analyze, and search manuscripts with semantic search, character/plot tracking, writing analysis, and content enhancement. Works with Claude, ChatGPT, and other AI assistants.

This report shows the evidence for scrivener-mcp@0.8.1. 1 of 5 known versions is blocked or flagged. The newest version, 0.9.3, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Direct source inspection confirms the scanner's critical finding. This meets the blocking policy for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install (postinstall) outside CI unless SCRIVENER_SKIP_POSTINSTALL=true

Impact

Adds a persistent executable MCP server entry to a user's Claude Desktop control surface.

Mechanism

Unconsented install-time foreign AI-agent configuration mutation

Policy narrative

On normal installation, package.json launches scripts/postinstall.cjs. The script finds or creates Claude Desktop's configuration in the user's home directory and adds mcpServers.scrivener configured to run npx scrivener-mcp. This is an unprompted mutation of a foreign AI-agent control surface, so a later Claude Desktop restart activates an executable package command.

AI rationale

Direct source inspection confirms the scanner's critical finding. This meets the blocking policy for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Evidence

package.jsonscripts/postinstall.cjsscripts/uninstall.jsdist/services/auto-setup/ai-config-wizard.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json invokes scripts/postinstall.cjs automatically on install.
scripts/postinstall.cjs locates or creates Claude Desktop configuration under the user home directory.
scripts/postinstall.cjs silently adds mcpServers.scrivener with command npx and args scrivener-mcp.
The postinstall runs without user confirmation; CI/opt-out guards do not make normal installs consensual.

Evidence against

The postinstall only adds its named server and preserves an existing scrivener entry.
scripts/uninstall.js removes only the named scrivener entry.
Runtime AI-key validation endpoints are provider-aligned and user-input driven.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 145 file(s), 1.55 MB of source, external domains: adoptium.net, api.anthropic.com, api.openai.com, brew.sh, docs.docker.com, docs.microsoft.com, download.keydb.dev, github.com, neo4j.com, ollama.ai

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/config-manager.jsView file

178if (includeSensitive) { L179: return JSON.parse(JSON.stringify(this.config)); L180: } ... L250: } L251: // Private methods L252: setupConfigPaths() { L253: const baseDir = process.cwd(); L254: this.configPaths = [ ... L378: for (const [envVar, configPath] of Object.entries(envMappings)) { L379: const value = process.env[envVar]; L380: if (value) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/config-manager.jsView on unpkg · L178

dist/services/auto-setup/ai-config-wizard.jsView file

9import * as readline from 'readline'; L10: import { execFileSync } from 'child_process'; L11: import { getLogger } from '../../core/logger.js'; ... L15: constructor() { L16: this.configDir = join(homedir(), '.scrivener-mcp'); L17: this.configPath = join(this.configDir, 'ai-config.json'); ... L24: input: process.stdin, L25: output: process.stdout, L26: }); ... L34: const configData = await readFile(this.configPath, 'utf-8'); L35: return JSON.parse(configData); L36: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/services/auto-setup/ai-config-wizard.jsView on unpkg · L9

scripts/postinstall.cjsView file

33if (!fs.existsSync(dir)) { L34: fs.mkdirSync(dir, { recursive: true }); L35: } ... L50: // Add scrivener MCP server if not already configured L51: if (!config.mcpServers) config.mcpServers = {}; L52: L53: if (config.mcpServers.scrivener) { L54: // Already configured -- don't touch it ... L57: L58: config.mcpServers.scrivener = { L59: command: 'npx', ... L63: try {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L33

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/config-manager.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

Findings

1 Critical2 High4 Medium7 Low

CriticalAi Agent Control Hijackscripts/postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/services/auto-setup/ai-config-wizard.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/core/config-manager.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to scrivener-mcp@0.8.1.

The versions list below shows the verdict for each recorded version.

Avoid installing scrivener-mcp@0.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-03 10:06:39.992Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

0.9.3latestSuspicious—WarnPublishedJul 13, 2026, 11:52 PM 0.9.2Suspicious—WarnPublishedJul 13, 2026, 11:47 PM 0.9.1Suspicious—WarnPublishedJul 13, 2026, 11:09 PM 0.9.0Suspicious—WarnPublishedJul 10, 2026, 9:05 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code