trace-mcp@2.0.2
Framework-aware code intelligence MCP server — 60 framework integrations, 81 languages, up to 99% token reduction
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe automatic launch-agent setup is a concrete lifecycle risk that warrants a warning. The inspected code does not establish malicious intent, credential exfiltration, or a foreign control-surface modification.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing or upgrading the package invokes postinstall.
Impact
A package daemon can persist and start without a separate user command, creating a lifecycle and agent-extension risk.
Mechanism
The lifecycle chain writes launcher configuration and can create and bootstrap a launchd plist; the updater also downloads a GitHub release asset after checksum comparison.
AI rationale
The automatic launch-agent setup is a concrete lifecycle risk that warrants a warning. The inspected code does not establish malicious intent, credential exfiltration, or a foreign control-surface modification.
Evidence
package.jsonscripts/postinstall-control-plane.mjsscripts/postinstall-app.mjs~/.trace-mcp/launcher.env~/.trace-mcp/bin/trace-mcp~/Library/LaunchAgents/com.trace-mcp.server.plist
Network endpoints1
api.github.com/repos/${GITHUB_REPO}/releases/latest
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package runs three scripts automatically through its postinstall hook.
- The control-plane script writes package-owned launcher files and installs a macOS launch agent that starts the daemon on first install.
- The app updater retrieves release assets from GitHub and verifies a sibling checksum before use.
Evidence against
- The inspected lifecycle code showed no credential collection or transfer to an unrelated endpoint.
- The persistence targets are named for this package rather than a foreign agent configuration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall-app.mjsView file
17* not destroy the working installation.
L18: * - `unzip` is invoked with execFileSync (no shell) to avoid argument
L19: * injection via asset names.
...
L23:
L24: import { execFileSync } from 'node:child_process';
L25: import crypto from 'node:crypto';
L26: import fs from 'node:fs';
L27: import http from 'node:http';
L28: import https from 'node:https';
...
L49:
L50: if (process.env.TRACE_MCP_NO_AUTO_UPDATE === '1') process.exit(0);
L51:
Findings
6 High8 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/postinstall-app.mjs
HighSemantic Analysis Limitedscripts/calibrate-health-metrics.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/bench-toon.ts
HighKnown Malware Source Similarityscripts/count-advertised-tools.mjs
HighPrevious Version Dangerous Deltascripts/postinstall-app.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/trace-mcp-reindex.sh
MediumOversized Source Filedist/index.js
Affected versions and remediation
This report applies to trace-mcp@2.0.2.
See all versions of trace-mcp for other recorded verdicts.
- Review the evidence and your use of trace-mcp@2.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.