registry / wigolo / 0.1.40-beta.2

wigolo@0.1.40-beta.2

Local-first web intelligence MCP server for AI coding agents

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious behavior or install-time hijack was found. The real risk is explicit user-command setup that modifies AI-agent configuration and instructions to register wigolo as an MCP server and prefer its web tools.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `wigolo setup mcp` or `wigolo init` and selects agents.

Impact

Can change agent web-tool routing and install package-owned instructions/skills; no credential theft, exfiltration, or remote payload execution confirmed.

Mechanism

First-party AI-agent MCP and instruction setup

Rationale

Static inspection supports a warning for explicit first-party AI-agent extension setup, not a publish block. Scanner hits for shell, network, SSRF metadata, and dynamic import map to package-aligned CLI/web-search/plugin features with guards or user invocation.

Evidence

package.jsondist/index.jsdist/cli/setup-mcp.jsdist/cli/init.jsdist/cli/tui/config-writer.jsdist/cli/agents/codex.jsdist/cli/agents/claude-code.jsdist/cli/agents/utils.jsassets/blocks/codex/AGENTS.md.blockassets/blocks/claude-code/CLAUDE.md.blockdist/watch/ssrf.jsdist/plugins/loader.jsAGENTS.md~/.codex/config.toml~/.claude/CLAUDE.md~/.claude/skills/*~/.claude/commands/wigolo.md.cursor/rules/wigolo.mdc.github/copilot-instructions.md

Network endpoints10

github.com/searxng/searxng/archive/refs/heads/master.tar.gzduckduckgo.comapi.semanticscholar.orgapi.stackexchange.comapi.search.brave.comapi.github.comwww.bing.comdeveloper.mozilla.orgexport.arxiv.orglocalhost:11434

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Benign with medium false-positive risk.

Evidence for warning

Explicit `wigolo setup mcp`/`wigolo init` can write MCP entries for multiple AI tools in `dist/cli/tui/config-writer.js`.
Agent handlers install instruction blocks/skills/commands into AI-agent surfaces, including Codex `AGENTS.md`, Claude skills, Cursor rules, and VS Code instructions.
Installed blocks instruct agents to prefer wigolo for web operations, e.g. `assets/blocks/codex/AGENTS.md.block` and `assets/blocks/claude-code/CLAUDE.md.block`.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle scripts.
Entrypoint `dist/index.js` only dispatches CLI commands; setup/init are user-invoked, not install-time or import-time mutation.
MCP config entries point back to `npx -y wigolo`, a package-aligned local MCP server, not a foreign payload.
Network and shell use appears package-aligned: web search/fetch, local SearXNG/Docker/bootstrap, doctor probes, and LLM providers.
SSRF guard in `dist/watch/ssrf.js` blocks localhost, private IP ranges, and metadata hostnames for watched URLs.
Dynamic plugin loading in `dist/plugins/loader.js` is from configured local plugin directories, not remote code download.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 370 file(s), 1.34 MB of source, external domains: 127.0.0.1, api.github.com, api.search.brave.com, api.semanticscholar.org, api.stackexchange.com, api2.marginalia-search.com, devdocs.io, developer.mozilla.org, duckduckgo.com, example.com, export.arxiv.org, github.com, hn.algolia.com, lite.duckduckgo.com, lobste.rs, news.ycombinator.com, python.org, twitter.com, www.bing.com, www.example.com, www.google.com, www.mojeek.com

Source & flagged code

7 flagged

dist/searxng/docker.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

3import { createLogger } from "../logger.js";

4const log = createLogger("searxng");

5const CONTAINER_NAME = "wigolo-searxng";

6const IMAGE = "searxng/searxng:latest";

7function isContainerRunning(name) {

8 try {

9 const result = execSync(

10 `docker inspect --format '{{.State.Running}}' -- ${shellEscape(name)}`,

11 { stdio: "pipe", encoding: "utf-8" }

12 ).trim();

13 return result === "true";

14 } catch {

15 return false;

16 }

17}

18function stopContainer(name) {

19 try {

20 const escaped = shellEscape(name);

21 execSync(`docker stop -- ${escaped} && docker rm -- ${escaped}`, { stdio: "pipe" });

dist/plugins/loader.jsView file

Lines 64-104javascript

64 }

65 continue;

66 }

67 if (!pkgJson.main) {

68 result.errors.push({

69 pluginName,

70 message: `plugin ${pluginName} has no main field in package.json`

71 });

72 continue;

dist/search/evidence.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

3import { countTokens, truncateByTokens } from "./tokens.js";

4import { applyOutputBudget } from "./truncate.js";

dist/watch/ssrf.jsView file

Lines 1-21javascript

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);

2const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([

3 "localhost",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.js

dist/extraction/site-extractors/amazon.jsView file

Lines 229-269javascript

229}

230function parseOverviewSpecifications(document) {

231 const out = /* @__PURE__ */ Object.create(null);

232 const rows = document.querySelectorAll("#productOverview_feature_div table tr");

dist/cli/doctor.jsView file

Lines 42-82javascript

42 return [

43 ` provider: ${provider} (key in ${location})`,

44 ` key (masked): ${masked}`

45 ];

46}

47function checkPython() {

48 const python = resolvePythonExe

Source & flagged code

7 flagged · loading source

dist/searxng/docker.jsView file

1import { execSync } from "node:child_process"; L2: import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

dist/plugins/loader.jsView file

84const fileUrl = pathToFileURL(entryPath).href; L85: mod = await import(fileUrl); L86: } catch (err) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/loader.jsView on unpkg · L84

dist/search/evidence.jsView file

1import { createHash } from "node:crypto"; L2: import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

dist/watch/ssrf.jsView file

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]); L2: const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([ L3: "localhost", ... L69: reason: `${fieldLabel} is not a valid URL`, L70: hint: 'Pass a fully qualified http(s) URL (e.g. "https://example.com/path").' L71: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.jsView on unpkg · L1

dist/extraction/site-extractors/amazon.jsView file

249contains invisible/control Unicode U+200D (zero width joiner) const cleaned = raw.replace(/[<U+200D><U+200E><U+200F><U+200B>]/g, "").trim();

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/extraction/site-extractors/amazon.jsView on unpkg · L249

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/cli/mcp.js -> dist/server.js -> dist/extraction/pipeline.js -> dist/extraction/v1/site-extractors.js -> dist/extraction/site-extractors/amazon.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/extraction/site-extractors/amazon.jsView on unpkg

dist/cli/doctor.jsView file

62try { L63: const r = spawnSync("npx", ["playwright", "--version"], { encoding: "utf-8", timeout: 5e3 }); L64: if (r.status === 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/doctor.jsView on unpkg · L62

Findings

2 Critical4 High4 Medium6 Low

CriticalTrojan Source Unicodedist/extraction/site-extractors/amazon.js

CriticalTrigger Reachable Dangerous Capabilitydist/extraction/site-extractors/amazon.js

HighChild Processdist/searxng/docker.js

HighShell

HighCloud Metadata Accessdist/watch/ssrf.js

HighRuntime Package Installdist/cli/doctor.js

MediumDynamic Requiredist/plugins/loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/search/evidence.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

83%Warn

Verdict confidence

IntentBenign

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorTowhid Khan

Maintainersknockoutez

Version0.1.43-beta.2

PublishedJul 6, 2026

LicenseAGPL-3.0-only

Dependencies29

Integrityverified

Package size1.42 MB

Files1,500

Keywordsmcpmcp-serverweb-searchweb-scrapingai-agentlocal-firstcontent-extractionsearch

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/types.d.tsexports mapbin → wigolo

Runtimenode >=20

Artifact5.00 MB · 1,500 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: bench:agent, bench:embedding, bench:embedding:quality, bench:extraction +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsCopyleftLicense

Source & flagged code

7 flagged

dist/searxng/docker.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

3import { createLogger } from "../logger.js";

4const log = createLogger("searxng");

5const CONTAINER_NAME = "wigolo-searxng";

6const IMAGE = "searxng/searxng:latest";

7function isContainerRunning(name) {

8 try {

9 const result = execSync(

10 `docker inspect --format '{{.State.Running}}' -- ${shellEscape(name)}`,

11 { stdio: "pipe", encoding: "utf-8" }

12 ).trim();

13 return result === "true";

14 } catch {

15 return false;

16 }

17}

18function stopContainer(name) {

19 try {

20 const escaped = shellEscape(name);

21 execSync(`docker stop -- ${escaped} && docker rm -- ${escaped}`, { stdio: "pipe" });

dist/plugins/loader.jsView file

Lines 64-104javascript

64 }

65 continue;

66 }

67 if (!pkgJson.main) {

68 result.errors.push({

69 pluginName,

70 message: `plugin ${pluginName} has no main field in package.json`

71 });

72 continue;

dist/search/evidence.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

3import { countTokens, truncateByTokens } from "./tokens.js";

4import { applyOutputBudget } from "./truncate.js";

dist/watch/ssrf.jsView file

Lines 1-21javascript

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);

2const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([

3 "localhost",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.js

dist/extraction/site-extractors/amazon.jsView file

Lines 229-269javascript

229}

230function parseOverviewSpecifications(document) {

231 const out = /* @__PURE__ */ Object.create(null);

232 const rows = document.querySelectorAll("#productOverview_feature_div table tr");

dist/cli/doctor.jsView file

Lines 42-82javascript

42 return [

43 ` provider: ${provider} (key in ${location})`,

44 ` key (masked): ${masked}`

45 ];

46}

47function checkPython() {

48 const python = resolvePythonExe