slaunt@0.1.10
Privacy-first MCP agent access auditor for Claude and Codex
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package does not automatically execute during installation, but its explicit installer registers a remote MCP server in user AI-agent configuration. That is a real, user-invoked agent capability risk rather than evidence of autonomous malware.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI with --install-slaunt.
Impact
A configured AI client may subsequently connect to the remote Slaunt MCP service.
Mechanism
Explicit mutation of AI-agent MCP configuration to register a remote server.
AI rationale
The package does not automatically execute during installation, but its explicit installer registers a remote MCP server in user AI-agent configuration. That is a real, user-invoked agent capability risk rather than evidence of autonomous malware.
Evidence
dist/cli.jsdist/config/install.js.codex/config.toml.claude.jsonLibrary/Application Support/Claude/claude_desktop_config.json
Network endpoints1
central-mcp-ccr-production.up.railway.app/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An explicit CLI option installs a remote Slaunt MCP server into detected AI-client configurations.
- The installer enables that server in Codex configuration and uses a third-party HTTPS endpoint by default.
- This creates an externally controlled agent capability after a user invokes the install option.
Evidence against
- package.json has no install, postinstall, or preinstall lifecycle hook.
- Configuration mutation is gated by the explicit --install-slaunt command-line option.
- The installer rejects non-HTTPS remote URLs and preserves existing configurations with backups.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/explanation/local.jsView file
311package = slaunt; repositoryIdentity = slaunt-audit; dependency = node-llama-cpp
L311: async function loadBundledRuntime() {
L312: const { getLlama } = await import('node-llama-cpp');
L313: const modelPath = await resolveBundledModelPath();
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/explanation/local.jsView on unpkg · L311•matchType = previous_version_dangerous_delta
matchedPackage = slaunt@0.1.8
matchedIdentity = npm:c2xhdW50:0.1.8
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/explanation/local.jsView on unpkgdist/explanation/local.js#virtual:normalized:round1View file
Findings
3 High4 Medium5 Low
HighCopied Package Dependency Bridgedist/explanation/local.js
HighSemantic Analysis Limiteddist/explanation/local.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/explanation/local.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/cli.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to slaunt@0.1.10.
See all versions of slaunt for other recorded verdicts.
- Review the evidence and your use of slaunt@0.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.