registry / tunnel-mcp / 0.1.7

tunnel-mcp@0.1.7

Let two developers' Claude agents talk directly through an ephemeral, end-to-end-encrypted tunnel.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package automatically mutates a broad Claude agent control surface at npm install time by copying its bundled skill into the user's home Claude skills directory. This is unconsented lifecycle delivery into a foreign AI-agent surface, even though the content is product-aligned and safety-oriented.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install lifecycle postinstall

Impact

Installs package-supplied agent instructions into a user-level Claude skills directory without an explicit install-skill command.

Mechanism

postinstall copies bundled Claude skill into ~/.claude/skills

Policy narrative

On package installation, the postinstall script best-effort imports the built installer and copies the bundled tunnel-etiquette skill into ~/.claude/skills/tunnel-etiquette. That writes package-supplied Claude skill instructions into a user-level agent control surface without an explicit user command, with only opt-out environment guards. Runtime tunnel/cloudflared behavior is package-aligned, but the lifecycle mutation itself is the blockable behavior.

Rationale

Static inspection confirms an unconsented npm lifecycle write into ~/.claude/skills, a foreign/broad AI-agent control surface covered by the block policy. The planted content appears benign and safety-oriented, but policy treats the lifecycle delivery mechanism as malicious control-surface hijack.

Evidence

package.jsonpostinstall.mjsdist/skillInstall.jsskill/tunnel-etiquette/SKILL.mddist/cloudflared/provision.jsdist/session.jsdist/relay/hostRelay.jsdist/relay/guestClient.jsdist/config.js~/.claude/skills/tunnel-etiquette/SKILL.md~/.tunnel/bin/cloudflared~/.tunnel/sessions/*.jsonl

Network endpoints6

github.com/cloudflare/cloudflared/releases/download/2026.6.1developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/1.1.1.1/dns-query1.0.0.1/dns-query8.8.8.8/resolve*.trycloudflare.com

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for policy block

package.json defines postinstall: node postinstall.mjs.
postinstall.mjs imports dist/skillInstall.js and calls installSkillBestEffort during npm install.
dist/skillInstall.js defaults target to ~/.claude/skills and copies bundled skill/tunnel-etiquette there unless CI or TUNNEL_SKIP_SKILL_INSTALL is set.
skill/tunnel-etiquette/SKILL.md is planted agent-facing behavioral guidance for Claude tunnel sessions.
dist/cloudflared/provision.js can download and chmod a pinned cloudflared binary into ~/.tunnel/bin at runtime.
dist/session.js and relay files expose MCP tools for agent-to-agent chat over local WebSocket plus cloudflared tunnel.

Evidence against

The installed skill content is safety-oriented and warns agents to treat peer messages as untrusted input.
Skill install is idempotent and does not overwrite an existing skill unless the explicit CLI install uses force.
cloudflared download is runtime/user-invoked through tunnel_open, version-pinned, and SHA-256 verified.
No credential harvesting, destructive behavior, shell startup persistence, or arbitrary remote code execution found in inspected source.
Network behavior is aligned with the package's documented tunnel/MCP purpose.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 60.9 KB of source, external domains: 1.0.0.1, 1.1.1.1, 8.8.8.8, developers.cloudflare.com, github.com

Source & flagged code

2 flagged

package.jsonView file

Lines 13-53json

13 "skill",

14 "postinstall.mjs",

15 "README.md",

16 "LICENSE",

17 "CHANGELOG.md",

18 "SECURITY.md"

19 ],

20 "engines": {

21 "node": ">=20"

22 },

23 "scripts": {

24 "build": "tsc",

25 "test": "vitest run",

26 "test:coverage": "vitest run --coverage",

27 "typecheck": "tsc --noEmit",

28 "lint": "eslint .",

29 "format": "prettier --write .",

30 "format:check": "prettier --check .",

31 "dev": "tsx src/index.ts",

32 "e2e": "tsx scripts/e2e-two-agents.ts",

33 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "prepublishOnly": "npm run build"

35 },

36 "keywords": [

37 "mcp",

38 "model-context-protocol",

39 "claude",

40 "claude-code",

41 "ai-agents",

42 "agent-to-agent",

43 "cloudflare-tunnel",

44 "e2e-encryption",

45 "websocket",

46 "llm"

47 ],

48 "author": "zachlikefolio (https://github.com/zachlikefolio)",

49 "license": "MIT",

50 "repository": {

51 "type": "git",

52 "url": "git+https://github.com/zachlikefolio/tunnel-mcp.git"

53 },

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings