Loading npm security reports…

warp-agent-mcp@0.19.5: AI-agent control-surface risk | LPM Firewall

registry / warp-agent-mcp / 0.19.5

warp-agent-mcp@0.19.5

MCP server for the Warp freight API, covering the full booking lifecycle: mode compare (one call prices every eligible mode in parallel and returns a decision-complete recommendation with the cost-vs-transit math), quote (van/box-truck/FTL/LTL — LTL split

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently modifies Claude Desktop's MCP configuration to execute the package on future application starts. That launcher has the user's normal home-directory access and uses a local API credential for network requests.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install runs postinstall; later starting Claude Desktop starts the configured MCP launcher.

Impact

A package installation persists an executable MCP server into Claude Desktop without an explicit setup command, expanding the AI agent's available tool surface and enabling credentialed requests.

Mechanism

Install-time foreign AI-agent configuration injection followed by credentialed MCP execution.

Policy narrative

During npm installation, the postinstall hook locates or creates a Claude Desktop configuration file and inserts the package as an MCP server. When Claude Desktop later starts, it launches scripts/run.mjs with the user's normal home-directory access. The launcher starts dist/index.js, which reads ~/.warp/config.json; its client can attach that API key to requests to the Warp API. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The package automatically persists itself into Claude Desktop through a postinstall hook, which meets the install-control-surface blocking policy. The resulting MCP process reads a local API key and makes authenticated network requests.

Evidence

package.jsonscripts/postinstall.mjsscripts/run.mjsdist/index.jsdist/client.js~/.warp/config.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.mjsView file

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L9: import { homedir } from "node:os"; L10: import { spawn } from "node:child_process"; L11: import { fileURLToPath } from "node:url"; ... L13: L14: const __dirname = dirname(fileURLToPath(import.meta.url)); L15: // Point at dist/ (built from src/ at version-bump time) instead of the pre-baked ... L22: const homes = [ L23: process.env.HOME, L24: homedir(), ... L30: try { L31: const cfg = JSON.parse(readFileSync(join(h, ".warp", "config.json"), "utf8")); L32: if (cfg.api_key) return cfg.api_key;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/run.mjsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.6 matchedPath = scripts/run.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.mjsView on unpkg

scripts/postinstall.mjsView file

5L6: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L7: import { join } from "node:path"; ... L77: // Check if already configured correctly L78: const existing = config?.mcpServers?.warp; L79: if (existing?.command === warpEntry.command && ... L85: // Add/update the warp entry L86: config.mcpServers = config.mcpServers || {}; L87: config.mcpServers.warp = warpEntry; L88: L89: try { L90: mkdirSync(configDir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.6 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client.js#virtual:normalized:round1View on unpkg

scripts/check-description.mjsView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.6 matchedPath = scripts/check-description.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check-description.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 16-56json

16 "cursor"

17 ],

18 "homepage": "https://github.com/warpfreight/warp-agent-mcp#readme",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/warpfreight/warp-agent-mcp.git"

22 },

23 "type": "module",

24 "bin": {

25 "warp-agent-mcp": "scripts/run.mjs"

26 },

27 "files": [

28 "bin",

29 "dist",

30 "scripts",

31 "server.json"

32 ],

33 "scripts": {

34 "build": "node scripts/build-widget.mjs && tsc && node scripts/add-shebang.mjs",

35 "dev": "tsc --watch",

36 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "check:desc": "node scripts/check-description.mjs",

38 "prepublishOnly": "npm run build && node scripts/check-description.mjs",

39 "test": "node test/refund.mjs && node test/e2e.mjs",

40 "test:call-readiness": "node test/call-readiness.mjs"

41 },

42 "dependencies": {

43 "@modelcontextprotocol/sdk": "^1.12.1",

44 "zod": "^3.24.4"

45 },

46 "devDependencies": {

47 "@modelcontextprotocol/ext-apps": "^1.7.2",

48 "@types/node": "^25.6.0",

49 "esbuild": "^0.28.0",

50 "typescript": "^5.8.3"

51 },

52 "engines": {

53 "node": ">=20"

54 },

55 "license": "MIT",

56 "bugs": {

scripts/run.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2/**

3 * MCP launcher — reads API key from ~/.warp/config.json and starts the server.

4 * This runs as the MCP command so it inherits the real HOME and filesystem access,

5 * unlike the bundled server which may run in a sandboxed context.

6 */

7import { readFileSync } from "node:fs";

8import { join } from

scripts/postinstall.mjsView file

Lines 1-25javascript

1/**

2 * postinstall — auto-configures Claude Desktop on install.

3 * Adds the warp MCP entry to claude_desktop_config.json if not already there.

4 */

5

6import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

7import { join } from "node:path";

Critical

dist/client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client.js#virtual:normalized:round1View on unpkg

scripts/check-description.mjsView file

•matchType = normalized_sha256 matchedPackage = warp-agent-mcp@0.19.6 matchedPath = scripts/check-description.mjs matchedIdentity = npm:d2FycC1hZ2VudC1tY3A:0.19.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check-description.mjsView on unpkg