trace-mcp@3.11.0

Framework-aware code intelligence MCP server — 87 framework integrations, 81 languages, 40–50% fewer tokens on average

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not proven credential theft or foreign AI-client takeover, but automatic postinstall persistence and application replacement are substantial package lifecycle behavior. The package-owned scope and checksum verification support a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install runs the postinstall lifecycle hook.

Impact

A package install can create an autostart service, restart its daemon, and modify matching installed app bundles without an explicit setup command.

Mechanism

Automatic user-level daemon persistence and package-owned app update.

AI rationale

Evidence

package.jsonscripts/postinstall-control-plane.mjsscripts/postinstall-app.mjs~/.trace-mcp/launcher.env~/.trace-mcp/bin/trace-mcp~/Library/LaunchAgents/com.trace-mcp.server.plist~/Applications/trace-mcp.app/Applications/trace-mcp.app

Network endpoints2

api.github.com127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The automatic postinstall chain runs two scripts that change user-level state.
The control-plane script writes an executable launcher under the user's trace-mcp directory.
On macOS it creates and bootstraps a persistent LaunchAgent that runs the package's HTTP daemon.
A separate postinstall script contacts GitHub release APIs and can replace installed trace-mcp app bundles.

Evidence against

The persistent service runs the package's own trace-mcp command and its health check is local only.
The app updater requires a matching SHA-256 release asset before applying an update.
No runtime dependency on trace-mcp itself is declared.
No install-time code directly edits Claude, Codex, or other AI-client configuration files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Source & flagged code

15 flagged

package.jsonView file

Lines 8-48json

8 "types": "dist/index.d.ts",

9 "bin": {

10 "trace-mcp": "dist/cli.js"

11 },

12 "scripts": {

13 "build": "tsup",

14 "dev": "tsup --watch",

15 "test": "vitest run",

16 "test:watch": "vitest",

17 "test:recall": "vitest run tests/recall-harness/recall.test.ts",

18 "test:recall:report": "tsx tests/recall-harness/runner.ts",

19 "typecheck": "tsc --noEmit",

20 "lint": "tsc --noEmit",

21 "format": "biome format --write",

22 "format:check": "biome format",

23 "biome:ci": "biome ci",

24 "serve": "tsx src/cli.ts serve",

25 "count:tools": "node scripts/count-advertised-tools.mjs",

26 "replay:check": "tsx scripts/replay-eval.ts",

27 "replay:update-baseline": "tsx scripts/replay-eval.ts --update-baseline",

28 "postinstall": "node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "prepublishOnly": "pnpm run build",

30 "prepare": "simple-git-hooks",

31 "docs:sitemap": "node scripts/gen-sitemap.mjs",

32 "docs:language-matrix": "tsx scripts/language-matrix.ts",

33 "docs:tools-index": "tsx scripts/tools-index.ts",

34 "gen:tz-country": "node scripts/gen-tz-country.mjs"

35 },

36 "simple-git-hooks": {

37 "pre-commit": "pnpm exec lint-staged"

38 },

39 "lint-staged": {

40 "*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,css}": [

41 "biome check --write --no-errors-on-unmatched"

42 ]

43 },

44 "engines": {

45 "node": ">=22.0.0"

46 },

47 "packageManager": "pnpm@10.33.0",

48 "license": "MIT",

scripts/verify-upgrade-path.mjsView file

Lines 5-45javascript

5 *

6 * Everything else that guards the updater asserts against a mock: the GitHub

7 * API is stubbed, the "bundle" is a fixture directory. That is what let TRA-357

8 * through — the code read correctly and shipped, and five real upgrades

scripts/capture-screenshots.mjs#virtual:normalized:round1View file

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L401: /** L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

hooks/trace-mcp-reindex.shView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = hooks/trace-mcp-reindex.sh matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/trace-mcp-reindex.shView on unpkg

•path = hooks/trace-mcp-reindex.sh kind = build_helper sizeBytes = 5850 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/trace-mcp-reindex.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 10770473 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12139894 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View on unpkg

scripts/capture-screenshots.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/capture-screenshots.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/capture-screenshots.mjsView on unpkg

scripts/postinstall-control-plane.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/postinstall-control-plane.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-control-plane.mjsView on unpkg

scripts/bench-toon.tsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/bench-toon.ts matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bench-toon.tsView on unpkg

scripts/gen-sitemap.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/gen-sitemap.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gen-sitemap.mjsView on unpkg

scripts/count-advertised-tools.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/count-advertised-tools.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/count-advertised-tools.mjsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/verify-upgrade-path.mjsView file

25L26: import { execFileSync } from 'node:child_process'; L27: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/verify-upgrade-path.mjsView on unpkg · L25

Findings

12 High8 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/verify-upgrade-path.mjs

HighShell

HighSame File Env Network Executionscripts/capture-screenshots.mjs#virtual:normalized:round1

HighCommand Output Exfiltrationscripts/capture-screenshots.mjs#virtual:normalized:round1

HighSemantic Analysis Limitedscripts/calibrate-health-metrics.mjs#virtual:normalized:round1

HighKnown Malware Source Similarityscripts/capture-screenshots.mjs

HighKnown Malware Source Similarityscripts/postinstall-control-plane.mjs

HighKnown Malware Source Similarityscripts/bench-toon.ts

HighKnown Malware Source Similarityscripts/gen-sitemap.mjs

High

Affected versions and remediation

This report applies to trace-mcp@3.11.0.

See all versions of trace-mcp for other recorded verdicts.

Review the evidence and your use of trace-mcp@3.11.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 18:57:04.205Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code