registry / AI-agent control-surface risk / tunnel-mcp

tunnel-mcp

Let two developers' Claude agents talk directly through an ephemeral, end-to-end-encrypted tunnel.

This report shows the evidence for tunnel-mcp@0.1.9. 3 of 9 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Under the install-control-surface policy, unconsented lifecycle writes into ~/.claude/skills are blockable AI-agent control hijack even when the content appears product-aligned. Other network and child-process behavior appears aligned with the tunnel MCP runtime and is not the basis for the block.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install lifecycle postinstall

Impact

Persistently changes Claude agent behavior for future sessions without explicit user invocation

Mechanism

copies bundled Claude skill into ~/.claude/skills

Policy narrative

On npm install, postinstall.mjs loads dist/skillInstall.js and calls installSkillBestEffort. That function resolves the default skills directory to ~/.claude/skills and copies the bundled tunnel-etiquette skill into it unless CI or TUNNEL_SKIP_SKILL_INSTALL is set. The planted instructions are safety-oriented and package-aligned, but the delivery is lifecycle-triggered and modifies a foreign Claude agent control surface without an explicit user command.

AI rationale

Evidence

package.jsonpostinstall.mjsdist/skillInstall.jsskill/tunnel-etiquette/SKILL.mddist/cloudflared/provision.jsdist/cloudflared/tunnelProcess.js~/.claude/skills/tunnel-etiquette/SKILL.md~/.tunnel/bin/cloudflared

Network endpoints6

github.com/cloudflare/cloudflared/releases/download/2026.6.1developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/1.1.1.1/dns-query1.0.0.1/dns-query8.8.8.8/resolve*.trycloudflare.com

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall: node postinstall.mjs
postinstall.mjs imports dist/skillInstall.js and calls installSkillBestEffort during npm install
dist/skillInstall.js defaults target to ~/.claude/skills and cpSync copies bundled skill there
skill/tunnel-etiquette/SKILL.md is package-supplied Claude agent instruction content

Evidence against

postinstall is best-effort, skips CI or TUNNEL_SKIP_SKILL_INSTALL, and does not overwrite existing skill by default
Runtime tunnel/network behavior is package-aligned MCP functionality
cloudflared download is user/runtime-triggered, pinned to a version, and SHA-256 checked before execution
No credential harvesting, destructive file operations, or unrelated exfiltration found

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 62.0 KB of source, external domains: 1.0.0.1, 1.1.1.1, 8.8.8.8, developers.cloudflare.com, github.com

Source & flagged code

2 flagged

package.jsonView file

Lines 15-55json

15 "postinstall.mjs",

16 "README.md",

17 "LICENSE",

18 "CHANGELOG.md",

19 "SECURITY.md"

20 ],

21 "engines": {

22 "node": ">=20"

23 },

24 "scripts": {

25 "build": "tsc",

26 "test": "vitest run",

27 "test:coverage": "vitest run --coverage",

28 "typecheck": "tsc --noEmit",

29 "lint": "eslint .",

30 "format": "prettier --write .",

31 "format:check": "prettier --check .",

32 "dev": "tsx src/index.ts",

33 "e2e": "tsx scripts/e2e-two-agents.ts",

34 "demo": "tsx scripts/demo.ts",

35 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "prepublishOnly": "npm run build"

37 },

38 "keywords": [

39 "mcp",

40 "model-context-protocol",

41 "claude",

42 "claude-code",

43 "ai-agents",

44 "agent-to-agent",

45 "cloudflare-tunnel",

46 "e2e-encryption",

47 "websocket",

48 "llm"

49 ],

50 "author": "zachlikefolio (https://github.com/zachlikefolio)",

51 "license": "MIT",

52 "repository": {

53 "type": "git",

54 "url": "git+https://github.com/zachlikefolio/tunnel-mcp.git"

55 },

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to tunnel-mcp@0.1.9.

The versions list below shows the verdict for each recorded version.

Avoid installing tunnel-mcp@0.1.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-04 22:52:50.544Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

0.1.9latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 2, 2026, 5:08 PM 0.1.8MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 2, 2026, 4:49 PM 0.1.7MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 1, 2026, 5:41 PM 0.1.6SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 1, 2026, 5:04 PM 0.1.5SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 1, 2026, 4:36 PM 0.1.3SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 1, 2026, 2:48 PM 0.1.2SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 1, 2026, 5:17 AM 0.1.1Clean—AllowPublishedJul 1, 2026, 4:35 AM 0.1.0Suspicious—WarnPublishedJul 1, 2026, 3:50 AM

95%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

Authorzachlikefolio

Version0.1.9

Latest on npm0.2.0

PublishedJul 2, 2026

LicenseMIT

Dependencies4

Integrityverified

Package size36.0 KB

Files43

Keywordsmcpmodel-context-protocolclaudeclaude-codeai-agentsagent-to-agentcloudflare-tunnele2e-encryption

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/index.d.tsbin → tunnel-mcp

Runtimenode >=20

Artifact109 KB · 43 files1 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocketUrlStringsManifest: clean

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Related packages

Other AI-agent control-surface risk packages

Source & flagged code