Loading npm security reports…

trace-mcp@3.8.0: AI-agent control-surface risk | LPM Firewall

registry / trace-mcp / 3.8.0

trace-mcp@3.8.0

Framework-aware code intelligence MCP server — 87 framework integrations, 81 languages, 40–50% fewer tokens on average

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently creates a persistent per-user service that executes this package's CLI. The same lifecycle flow can download and replace application bundles, and a bundled updater can reinstall the package globally.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation or upgrade runs postinstall; later application update handling can invoke a global npm install.

Impact

The package gains automatic execution through a LaunchAgent and can replace local application code outside the npm package directory.

Mechanism

Postinstall persistence, remote application replacement, and recursive global package installation.

Policy narrative

Installing the package automatically runs code that writes a launcher under the user's home directory and creates a launchd service configured with RunAtLoad and KeepAlive. That service executes the package CLI independently of the install command. The postinstall path also contacts GitHub for a release archive and can swap existing application bundles. A bundled update helper then invokes npm to globally install trace-mcp again, re-entering the lifecycle path.

Rationale

This is unconsented install-time persistence for an MCP control service, combined with remote code delivery and a self-reinstallation path. Integrity checks on the downloaded archive do not remove the broad automatic mutation and persistence behavior.

Evidence

package.jsonscripts/postinstall-control-plane.mjsscripts/postinstall-app.mjsscripts/apply-pending-update.mjs~/.trace-mcp/launcher.env~/.trace-mcp/bin/trace-mcp

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/count-advertised-tools.mjsView file

13*/ L14: import { spawn } from 'node:child_process'; L15: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

scripts/count-advertised-tools.mjsView on unpkg · L13

scripts/apply-pending-update.mjsView file

25L26: import { execFileSync, spawn, spawnSync } from 'node:child_process'; L27: import crypto from 'node:crypto'; ... L46: // end-to-end at all: `pgrep` answers differently depending on whether the L47: // developer happens to have trace-mcp.app open, `launchctl` would bounce the L48: // real daemon, and `open -a` would launch the throwaway sandbox bundle through ... L51: // tests over its helpers; the staging half (postinstall-app.mjs) did. L52: const PGREP_BIN = process.env.TRACE_MCP_PGREP_BIN || '/usr/bin/pgrep'; L53: const LAUNCHCTL_BIN = process.env.TRACE_MCP_LAUNCHCTL_BIN || '/bin/launchctl'; ... L55: L56: const LAUNCHER_ENV = path.join(os.homedir(), '.trace-mcp', 'launcher.env'); L57: const DAEMON_PLIST = path.join(

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/apply-pending-update.mjsView on unpkg · L25

scripts/capture-screenshots.mjs#virtual:normalized:round1View file

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L401: /** L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

hooks/trace-mcp-reindex.shView file

•path = hooks/trace-mcp-reindex.sh kind = build_helper sizeBytes = 5850 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/trace-mcp-reindex.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 10755526 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12105948 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-app.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = trace-mcp@3.10.0 matchedIdentity = npm:dHJhY2UtbWNw:3.10.0 similarity = 0.936 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall-app.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 8-48json

8 "types": "dist/index.d.ts",

9 "bin": {

10 "trace-mcp": "dist/cli.js"

11 },

12 "scripts": {

13 "build": "tsup",

14 "dev": "tsup --watch",

15 "test": "vitest run",

16 "test:watch": "vitest",

17 "test:recall": "vitest run tests/recall-harness/recall.test.ts",

18 "test:recall:report": "tsx tests/recall-harness/runner.ts",

19 "typecheck": "tsc --noEmit",

20 "lint": "tsc --noEmit",

21 "format": "biome format --write",

22 "format:check": "biome format",

23 "biome:ci": "biome ci",

24 "serve": "tsx src/cli.ts serve",

25 "count:tools": "node scripts/count-advertised-tools.mjs",

26 "replay:check": "tsx scripts/replay-eval.ts",

27 "replay:update-baseline": "tsx scripts/replay-eval.ts --update-baseline",

28 "postinstall": "node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "prepublishOnly": "pnpm run build",

30 "prepare": "simple-git-hooks",

31 "docs:sitemap": "node scripts/gen-sitemap.mjs",

32 "docs:language-matrix": "tsx scripts/language-matrix.ts",

33 "docs:tools-index": "tsx scripts/tools-index.ts",

34 "gen:tz-country": "node scripts/gen-tz-country.mjs"

35 },

36 "simple-git-hooks": {

37 "pre-commit": "pnpm exec lint-staged"

38 },

39 "lint-staged": {

40 "*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,css}": [

41 "biome check --write --no-errors-on-unmatched"

42 ]

43 },

44 "engines": {

45 "node": ">=22.0.0"

46 },

47 "packageManager": "pnpm@10.33.0",

48 "license": "MIT",

scripts/count-advertised-tools.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * Prints the tool surface THIS install serves — a real initialize + tools/list

4 * round-trip against the built server. Run after `pnpm run build`.

5 *

6 * TRA-268: this is not the number `docs/_data/counts.yml` quotes. Registration

7 * is gated on detected frameworks and on config, so the answer here changes

8 * with the repo and the machine (measured 150 / 165 / 172 across three

9 * environments). The documented number is derived statically instead — see

10 * tests/docs/tool-surface.ts.

scripts/apply-pending-update.mjsView file

Lines 5-45javascript

5 * via the `restart-app` IPC when a verified update zip is staged at

6 * ~/Applications/.trace-mcp-pending.zip. We:

7 *

8 * 1. Wait for the parent app PID to

scripts/capture-screenshots.mjs#virtual:normalized:round1View file

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

390// six grey placeholders is exactly the failure this pipeline exists to avoid. L391: const dashboard = `http://127.0.0.1:${DEMO_DAEMON_PORT}/api/dashboard`; L392: await fetch(`${dashboard}/refresh`, { method: "POST" }); ... L401: /** L402: * The guard"s health comes from a heartbeat an attached agent session writes.\n * A capture has no agent, so without this the showcase screenshot ships a red\n * \"Not running\" ba... L403: * policy") — the window comes up blank. Assigning `location.href` inside the\n * document keeps the app's own file origin, exactly as the main process does.\n */\nasync function na... L404: return;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/capture-screenshots.mjs#virtual:normalized:round1View on unpkg · L390

hooks/trace-mcp-reindex.shView file

•path = hooks/trace-mcp-reindex.sh kind = build_helper sizeBytes = 5850 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/trace-mcp-reindex.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 10755526 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12105948 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/calibrate-health-metrics.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-app.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = trace-mcp@3.10.0 matchedIdentity = npm:dHJhY2UtbWNw:3.10.0 similarity = 0.936 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall-app.mjsView on unpkg