registry / Install hook abuse / warp-agent-mcp

warp-agent-mcp

MCP server for the Warp freight API, covering the full booking lifecycle: mode compare (one call prices every eligible mode in parallel and returns a decision-complete recommendation with the cost-vs-transit math), quote (van/box-truck/FTL/LTL — LTL split

This report shows the evidence for warp-agent-mcp@0.20.1. 8 of 9 known versions are blocked or flagged. The newest version, 0.22.0, is flagged. See all versions.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

The automatic lifecycle hook performs concrete cross-platform Claude Desktop configuration mutation. This meets the install-hook abuse blocking policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs the postinstall lifecycle hook.

Impact

Installation can automatically alter a broad third-party AI-agent control surface and cause Claude Desktop to launch the package.

Mechanism

The hook selects a Claude configuration path, adds a Warp MCP entry, creates directories if needed, and writes the configuration.

Attack narrative

A normal package installation automatically invokes the postinstall script. That script writes a Warp MCP server entry into Claude Desktop configuration paths across supported platforms. This is unconsented install-time mutation of a foreign AI-agent control surface, enabling the package to be launched by Claude Desktop.

AI rationale

The automatic lifecycle hook performs concrete cross-platform Claude Desktop configuration mutation. This meets the install-hook abuse blocking policy.

Evidence

package.jsonscripts/postinstall.mjs

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package declares an automatic postinstall lifecycle hook.
The postinstall script targets Claude Desktop configuration locations on macOS, Windows, and Linux.
The hook creates or updates a Warp MCP server entry and writes the Claude configuration file.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 1.57 MB of source, external domains: customer.wearewarp.com, json-schema.org, nodejs.org, tracking.wearewarp.com, www.w3.org, www.wearewarp.com

Source & flagged code

9 flagged

package.jsonView file

Lines 16-56json

16 "cursor"

17 ],

18 "homepage": "https://github.com/warpfreight/warp-agent-mcp#readme",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/warpfreight/warp-agent-mcp.git"

22 },

23 "type": "module",

24 "bin": {

25 "warp-agent-mcp": "scripts/run.mjs"

26 },

27 "files": [

28 "bin",

29 "dist",

30 "scripts",

31 "server.json"

32 ],

33 "scripts": {

34 "build": "node scripts/sync-version.mjs && node scripts/build-widget.mjs && tsc && node scripts/add-shebang.mjs",

35 "dev": "tsc --watch",

36 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "check:desc": "node scripts/check-description.mjs",

38 "prepublishOnly": "npm run build && node scripts/check-description.mjs && node scripts/sync-manifest.mjs --check && node test/freight-review.mjs",

39 "test": "node test/refund.mjs && node test/e2e.mjs",

40 "test:call-readiness": "node test/call-readiness.mjs",

41 "sync:manifest": "node scripts/sync-manifest.mjs",

42 "test:freight-review": "node test/freight-review.mjs"

43 },

44 "dependencies": {

45 "@modelcontextprotocol/sdk": "^1.12.1",

46 "zod": "^3.24.4"

47 },

48 "devDependencies": {

49 "@modelcontextprotocol/ext-apps": "^1.7.2",

50 "@types/node": "^25.6.0",

51 "esbuild": "^0.28.0",

52 "typescript": "^5.8.3"

53 },

54 "engines": {

55 "node": ">=20"

56 },

scripts/run.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2/**

3 * MCP launcher — reads API key from ~/.warp/config.json and starts the server.

4 * This runs as the MCP command so it inherits the real HOME and filesystem access,

5 * unlike the bundled server which may run in a sandboxed context.

6 */

7import { readFileSync } from "node:fs";

8import { join } from

scripts/postinstall.mjsView file

Lines 1-25javascript

1/**

2 * postinstall — auto-configures Claude Desktop on install.

3 * Adds the warp MCP entry to claude_desktop_config.json if not already there.

4 */

6import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

7import { join } from "node:path";

Critical

dist/client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client.js#virtual:normalized:round1View on unpkg

scripts/check-description.mjsView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = scripts/check-description.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check-description.mjsView on unpkg

bin/warp-agent-mcpView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.3 matchedPath = bin/warp-agent-mcp matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warp-agent-mcpView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.mjsView file

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L9: import { homedir } from "node:os"; L10: import { spawn } from "node:child_process"; L11: import { fileURLToPath } from "node:url"; ... L13: L14: const __dirname = dirname(fileURLToPath(import.meta.url)); L15: // Point at dist/ (built from src/ at version-bump time) instead of the pre-baked ... L22: const homes = [ L23: process.env.HOME, L24: homedir(), ... L30: try { L31: const cfg = JSON.parse(readFileSync(join(h, ".warp", "config.json"), "utf8")); L32: if (cfg.api_key) return cfg.api_key;

Findings

1 Critical7 High4 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/run.mjs

HighSemantic Analysis Limiteddist/client.js#virtual:normalized:round1

HighKnown Malware Source Similarityscripts/run.mjs

HighKnown Malware Source Similarityscripts/check-description.mjs

HighKnown Malware Source Similarityscripts/postinstall.mjs

HighKnown Malware Source Similaritybin/warp-agent-mcp

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to warp-agent-mcp@0.20.1.

The versions list below shows the verdict for each recorded version.

Avoid installing warp-agent-mcp@0.20.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-29 08:50:06.079Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

0.22.0latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 7:58 PM 0.20.1shownMaliciousInstall Hook AbuseBlockPublishedSep 21, 2026, 12:10 PM 0.19.6MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 11, 2026, 6:51 PM 0.19.5MaliciousSoft block: AI-agent control surfaceBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code