registry / Persistence / trace-mcp / 3.34.3

trace-mcp@3.34.3

Framework-aware code intelligence MCP server — 88 framework integrations, 81 languages, 72.7% fewer input tokens to review a pull request, comprehension at parity

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The source supports a warning for automatic postinstall persistence and update activity. It does not establish a foreign AI-agent control-surface takeover, credential exfiltration, or a self-dependent lifecycle chain that would justify blocking.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package invokes its postinstall hook.

Impact

Installation can create or refresh persistent user-level execution outside the package directory.

Mechanism

The hook writes launcher state, copies a launcher shim, refreshes a macOS launch agent, and checks GitHub release metadata for an app update.

AI rationale

Evidence

~/.trace/launcher.env~/.trace/bin/trace~/Library/LaunchAgents/com.trace-mcp.server.plist

Network endpoints1

api.github.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs three scripts automatically through a postinstall hook.
The control-plane installer writes a launcher environment file and executable launcher shim outside the package.
On macOS, the installer refreshes a launch agent unless a prior opt-out marker exists.
The app installer queries GitHub releases and selects a release asset during installation.

Evidence against

The control-plane script skips ephemeral package locations and includes an opt-out environment variable.
The app-update path requires a matching checksum asset before continuing.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

26 flagged

package.jsonView file

Lines 16-56json

16 "test": "vitest run",

17 "test:watch": "vitest",

18 "test:recall": "vitest run tests/recall-harness/recall.test.ts",

19 "test:recall:report": "tsx tests/recall-harness/runner.ts",

20 "eval:embeddings": "node scripts/embedding-eval/run.mjs",

21 "typecheck": "tsc --noEmit",

22 "lint": "tsc --noEmit",

23 "format": "biome format --write",

24 "format:check": "biome format",

25 "biome:ci": "biome ci",

26 "serve": "tsx src/cli.ts serve",

27 "check:remote-claims": "node scripts/check-remote-claims.mjs",

28 "count:tools": "node scripts/count-advertised-tools.mjs",

29 "record:wire-fixtures": "tsx scripts/record-wire-fixtures.ts",

30 "replay:check": "tsx scripts/replay-eval.ts",

31 "replay:update-baseline": "tsx scripts/replay-eval.ts --update-baseline",

32 "bench:state-replay": "tsx scripts/state-trace-replay.ts",

33 "bench:state-recall": "tsx scripts/bench-state-recall.ts",

34 "bench:index-throughput": "tsx scripts/bench-index-throughput.ts --json docs/perf/index-throughput.json",

35 "bench:session-scaling": "tsx scripts/bench-session-scaling.ts",

36 "postinstall": "node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "prepublishOnly": "pnpm run build",

38 "prepare": "simple-git-hooks",

39 "docs:sitemap": "node scripts/gen-sitemap.mjs && node scripts/gen-llms-full.mjs",

40 "docs:language-matrix": "tsx scripts/language-matrix.ts",

41 "docs:tools-index": "tsx scripts/tools-index.ts",

42 "docs:config-index": "tsx scripts/config-index.ts",

43 "gen:tz-country": "node scripts/gen-tz-country.mjs",

44 "geo:battery": "node scripts/geo-battery.mjs"

45 },

46 "simple-git-hooks": {

47 "pre-commit": "pnpm exec lint-staged"

48 },

49 "lint-staged": {

50 "*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,css}": [

51 "biome check --write --no-errors-on-unmatched"

52 ]

53 },

54 "engines": {

55 "node": ">=22.0.0"

56 },

dist/proxy.jsView file

27661// src/daemon/lifecycle.ts L27662: import { execSync, execFileSync as execFileSync2, spawn } from "child_process"; L27663: import fs12 from "fs";

High

Child Process

Package source references child process execution.

dist/proxy.jsView on unpkg · L27661

2474function hasPreloadFlags() { L2475: const execArgv = process.execArgv; L2476: for (let i = 0; i < execArgv.length; i++) {

High

Shell

Package source references shell execution.

dist/proxy.jsView on unpkg · L2474

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = dist/proxy.js matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/proxy.jsView on unpkg

2import { createRequire as __tmcpCreateRequire } from 'node:module'; L3: const require = __tmcpCreateRequire(import.meta.url); L4: var __create = Object.create;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/capture-screenshots.mjs#virtual:normalized:round1View file

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L401: /** L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

scripts/verify-upgrade-path.mjsView file

25L26: import { execFileSync } from 'node:child_process'; L27: import fs from 'node:fs'; ... L34: L35: if (process.platform !== 'darwin') { L36: console.log('skip: macOS only'); ... L48: const repoRoot = path.resolve(new URL('..', import.meta.url).pathname); L49: const expected = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf-8')).version; L50: ... L62: try { L63: const res = await fetch(`https://api.github.com/repos/${REPO}/releases?per_page=10`, { L64: headers: { 'User-Agent': 'trace-mcp' },

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/verify-upgrade-path.mjsView on unpkg · L25

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/verify-upgrade-path.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/verify-upgrade-path.mjsView on unpkg

scripts/record-wire-fixtures.tsView file

20* Usage: L21: * npx tsx scripts/record-wire-fixtures.ts [--project <root>] [--port <port>] L22: * ... L25: */ L26: import { spawn } from 'node:child_process'; L27: import fs from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/record-wire-fixtures.tsView on unpkg · L20

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/record-wire-fixtures.ts matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/record-wire-fixtures.tsView on unpkg

hooks/trace-mcp-reindex.shView file

•path = hooks/trace-mcp-reindex.sh kind = build_helper sizeBytes = 10437 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/trace-mcp-reindex.shView on unpkg

dist/snapshot-backend.jsView file

•path = dist/snapshot-backend.js kind = oversized_source_file sizeBytes = 11326316 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/snapshot-backend.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 13263416 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

scripts/bench-index-throughput.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/bench-index-throughput.ts#virtual:normalized:round1View on unpkg

scripts/capture-screenshots.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/capture-screenshots.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/capture-screenshots.mjsView on unpkg

scripts/verify-win-update.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/verify-win-update.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/verify-win-update.mjsView on unpkg

scripts/bench-session-scaling.tsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/bench-session-scaling.ts matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bench-session-scaling.tsView on unpkg

scripts/gen-readme-banner.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/gen-readme-banner.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gen-readme-banner.mjsView on unpkg

scripts/gen-sitemap.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/gen-sitemap.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gen-sitemap.mjsView on unpkg

scripts/perf/daemon-query-alloc.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/perf/daemon-query-alloc.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/perf/daemon-query-alloc.mjsView on unpkg

scripts/perf/daemon-serving-rss.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/perf/daemon-serving-rss.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/perf/daemon-serving-rss.mjsView on unpkg

scripts/bench-name-tokens.tsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/bench-name-tokens.ts matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bench-name-tokens.tsView on unpkg

scripts/bench-pr-quality.tsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.25.1 matchedPath = scripts/bench-pr-quality.ts matchedIdentity = npm:dHJhY2UtbWNw:3.25.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bench-pr-quality.tsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy.jsView file

27661// src/daemon/lifecycle.ts L27662: import { execSync, execFileSync as execFileSync2, spawn } from "child_process"; L27663: import fs12 from "fs";

High

Child Process

Package source references child process execution.

dist/proxy.jsView on unpkg · L27661

Findings

20 High9 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/proxy.js

HighShelldist/proxy.js

HighSame File Env Network Executionscripts/capture-screenshots.mjs#virtual:normalized:round1

HighCommand Output Exfiltrationscripts/capture-screenshots.mjs#virtual:normalized:round1

HighSandbox Evasion Gated Capabilityscripts/verify-upgrade-path.mjs

HighRuntime Package Installscripts/record-wire-fixtures.ts

HighSemantic Analysis Limitedscripts/bench-index-throughput.ts#virtual:normalized:round1

HighKnown Malware Source Similarityscripts/capture-screenshots.mjs

HighKnown Malware Source Similarityscripts/verify-upgrade-path.mjs

Affected versions and remediation

This report applies to trace-mcp@3.34.3.

See all versions of trace-mcp for other recorded verdicts.

Review the evidence and your use of trace-mcp@3.34.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 01:40:21.884Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code