registry  /  tunnel-mcp  /  0.1.3

tunnel-mcp@0.1.3

Let two developers' Claude agents talk directly through an ephemeral, end-to-end-encrypted tunnel.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package performs an install-time mutation of a Claude agent control surface. It automatically installs a bundled skill into the user's Claude skills directory without an explicit CLI action.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install with lifecycle scripts enabled
Impact
Persistent agent behavior modification for Claude sessions, despite benign/safety-themed skill content.
Mechanism
postinstall copies bundled Claude skill into ~/.claude/skills
Policy narrative
On npm install, postinstall.mjs loads dist/skillInstall.js and calls installSkillBestEffort. Unless skipped by CI or TUNNEL_SKIP_SKILL_INSTALL, that function copies the bundled tunnel-etiquette skill into ~/.claude/skills/tunnel-etiquette, adding persistent instructions that Claude may load in future tunnel sessions.
Rationale
Source inspection confirms unconsented lifecycle mutation of an AI-agent instruction/control surface, which is a blocking behavior for the upstream firewall even though the installed content is safety-oriented and package-aligned. Other network and child_process use supports the documented Cloudflare tunnel feature and does not show exfiltration or destructive behavior. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsonpostinstall.mjsdist/skillInstall.jsskill/tunnel-etiquette/SKILL.mddist/cloudflared/provision.jsdist/cloudflared/tunnelProcess.js~/.claude/skills/tunnel-etiquette/SKILL.md
Network endpoints3
github.com/cloudflare/cloudflared/releases/latest/downloaddevelopers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/*.trycloudflare.com

Decision evidence

public snapshot
AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for policy block
  • package.json defines install-time postinstall: node postinstall.mjs
  • postinstall.mjs imports dist/skillInstall.js and calls installSkillBestEffort on npm install
  • dist/skillInstall.js defaults target to os.homedir()/.claude/skills and cpSync copies bundled skill there
  • skill/tunnel-etiquette/SKILL.md is an agent instruction surface with imperative rules for Claude tunnel sessions
Evidence against
  • postinstall is best-effort, skips CI or TUNNEL_SKIP_SKILL_INSTALL, and does not overwrite existing skill by default
  • Bundled skill content is safety-oriented, warning that peer messages are untrusted input
  • Runtime tunnel behavior is package-aligned: MCP tools open/join/listen/say over Cloudflare tunnel with encrypted chat
  • No credential harvesting, broad file collection, destructive behavior, or arbitrary eval found
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 16 file(s), 53.2 KB of source, external domains: developers.cloudflare.com, github.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cloudflared/provision.jsView file
4import crypto from 'node:crypto'; L5: import { execSync, execFileSync } from 'node:child_process'; L6: import { pipeline } from 'node:stream/promises'; ... L8: import { BIN_DIR } from '../config.js'; L9: const RELEASE_BASE = 'https://github.[redacted]'; L10: const MANUAL_INSTALL_POINTER = 'https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/'; ... L32: try { L33: const cmd = process.platform === 'win32' ? 'where cloudflared' : 'command -v cloudflared'; L34: const out = execSync(cmd, { stdio: ['ignore', 'pipe', 'ignore'] })
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cloudflared/provision.jsView on unpkg · L4
dist/cloudflared/tunnelProcess.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = tunnel-mcp@0.1.2 matchedIdentity = npm:dHVubmVsLW1jcA:0.1.2 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cloudflared/tunnelProcess.jsView on unpkg

Findings

1 Critical2 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/cloudflared/tunnelProcess.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/cloudflared/provision.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings