slaunt@0.1.8
Privacy-first MCP agent access auditor for Claude and Codex
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real, explicit-user-command AI-agent configuration mutation capability. It lacks install hooks and no concrete stealth, exfiltration, payload, or persistence behavior was found, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs slaunt audit --install-slaunt.
Impact
Affected AI clients may connect to the configured remote MCP endpoint in later use.
Mechanism
Writes a Slaunt MCP endpoint into detected AI-agent configuration files.
AI rationale
The package has a real, explicit-user-command AI-agent configuration mutation capability. It lacks install hooks and no concrete stealth, exfiltration, payload, or persistence behavior was found, so this warrants a warning rather than a block.
Evidence
dist/cli.jsdist/config/install.js~/.claude.json~/.codex/config.toml
Network endpoints1
central-mcp-ccr-production.up.railway.app/mcp
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit --install-slaunt command invokes an installer that changes detected AI-client configuration files.
- The installer adds a Slaunt MCP entry to Claude and Codex configuration files, using a remote HTTPS endpoint.
- The CLI can also start configured local MCP servers only after approval or an explicit automation flag.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Configuration mutation requires the user to pass --install-slaunt; it is not automatic at install time.
- The installer refuses symlinks, backs up existing files, and limits its own endpoint to HTTPS.
- No credential harvesting, secret exfiltration, hidden payload execution, or self-dependency was found.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/explanation/local.jsView file
233package = slaunt; repositoryIdentity = slaunt-audit; dependency = node-llama-cpp
L233: async function loadBundledRuntime() {
L234: const { getLlama } = await import('node-llama-cpp');
L235: const modelPath = await resolveBundledModelPath();
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/explanation/local.jsView on unpkg · L233dist/explanation/local.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/explanation/local.js#virtual:normalized:round1View on unpkgdist/cli.js
Findings
2 High5 Medium5 Low
HighCopied Package Dependency Bridgedist/explanation/local.js
HighSemantic Analysis Limiteddist/explanation/local.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/cli.js
MediumAi Review Evidencedist/cli.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to slaunt@0.1.8.
See all versions of slaunt for other recorded verdicts.
- Review the evidence and your use of slaunt@0.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.