trace-mcp@3.6.0

Framework-aware code intelligence MCP server — 87 framework integrations, 81 languages, 40–50% fewer tokens on average

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a real install-time persistence and update surface, but the inspected source does not establish credential theft, third-party agent-control mutation, or other concrete malicious behavior. It warrants a warning as a first-party lifecycle risk.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation; subsequent macOS app update and restart for the nested global reinstall.

Impact

A background trace-mcp service can start automatically and package-controlled releases can refresh its application and CLI.

Mechanism

Install-time daemon persistence and remote application update.

AI rationale

Evidence

package.jsonscripts/postinstall-control-plane.mjsscripts/postinstall-app.mjsscripts/apply-pending-update.mjs~/.trace-mcp/launcher.env~/.trace-mcp/bin/trace-mcp~/Library/LaunchAgents/com.trace-mcp.server.plist~/Applications/trace-mcp.app/Applications/trace-mcp.app

Network endpoints1

api.github.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs three scripts automatically in postinstall.
The postinstall hook writes a per-user launcher configuration and executable shim.
On macOS it creates a launchd job with RunAtLoad and KeepAlive, starting a persistent local daemon.
The install hook fetches a release from GitHub and can replace an installed application; its updater can reinstall trace-mcp globally.

Evidence against

No dependency on trace-mcp itself appears in package.json.
The app update path requires an existing macOS app and checks a release checksum.
No source evidence shows secret collection, exfiltration, or mutation of third-party AI-client settings during install.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/count-advertised-tools.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * Prints the tool surface THIS install serves — a real initialize + tools/list

4 * round-trip against the built server. Run after `pnpm run build`.

5 *

6 * TRA-268: this is not the number `docs/_data/counts.yml` quotes. Registration

7 * is gated on detected frameworks and on config, so the answer here changes

8 * with the repo and the machine (measured 150 / 165 / 172 across three

9 * environments). The documented number is derived statically instead — see

10 * tests/docs/tool-surface.ts.

11 *

12 * pnpm run count:tools [--names]

13 */

14import { spawn } from 'node:child_process';

15import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

scripts/count-advertised-tools.mjsView on unpkg · L13

17const repoRoot = fileURLToPath(new URL('..', import.meta.url));

18const showNames = process.argv.includes('--names');

20const server = spawn('node', ['dist/cli.js', 'serve'], {

21 cwd: repoRoot,

22 env: { ...process.env, TRACE_MCP_NO_DAEMON: '1' },

23 stdio: ['pipe', 'pipe', 'ignore'],

24});

26const send = (msg) => server.stdin.write(`${JSON.stringify(msg)}\n`);

28const timeout = setTimeout(() => {

29 console.error('timed out waiting for tools/list');

30 server.kill();

31 process.exit(1);

32}, 120_000);

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/count-advertised-tools.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/count-advertised-tools.mjsView on unpkg

scripts/capture-screenshots.mjs#virtual:normalized:round1View file

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L401: /** L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

hooks/trace-mcp-reindex.shView file

•path = hooks/trace-mcp-reindex.sh kind = build_helper sizeBytes = 5850 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/trace-mcp-reindex.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 10741090 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12090113 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View on unpkg

scripts/capture-screenshots.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/capture-screenshots.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/capture-screenshots.mjsView on unpkg

scripts/postinstall-control-plane.mjsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/postinstall-control-plane.mjs matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-control-plane.mjsView on unpkg

scripts/bench-toon.tsView file

•matchType = normalized_sha256 matchedPackage = trace-mcp@3.8.0 matchedPath = scripts/bench-toon.ts matchedIdentity = npm:dHJhY2UtbWNw:3.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bench-toon.tsView on unpkg

scripts/postinstall-app.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = trace-mcp@3.25.0 matchedIdentity = npm:dHJhY2UtbWNw:3.25.0 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall-app.mjsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/count-advertised-tools.mjsView file

13*/ L14: import { spawn } from 'node:child_process'; L15: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

scripts/count-advertised-tools.mjs

Findings

1 Critical10 High8 Medium5 Low

CriticalPrevious Version Dangerous Deltascripts/postinstall-app.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/count-advertised-tools.mjs

HighShell

HighSame File Env Network Executionscripts/capture-screenshots.mjs#virtual:normalized:round1

HighCommand Output Exfiltrationscripts/capture-screenshots.mjs#virtual:normalized:round1

HighSemantic Analysis Limitedscripts/calibrate-health-metrics.mjs#virtual:normalized:round1

HighKnown Malware Source Similarityscripts/capture-screenshots.mjs

HighKnown Malware Source Similarityscripts/postinstall-control-plane.mjs

HighKnown Malware Source Similarityscripts/bench-toon.ts

Affected versions and remediation

This report applies to trace-mcp@3.6.0.

See all versions of trace-mcp for other recorded verdicts.

Review the evidence and your use of trace-mcp@3.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 06:33:23.169Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code