registry / wikimemory / 0.2.4

wikimemory@0.2.4

Personal, passkey-protected memory for Claude, Codex, and other MCP clients

AI Security Review

scanned 17h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Explicit CLI commands provision and manage a user-owned Cloudflare memory service; explicit client commands can add its MCP endpoint or copy its skills.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs wikimemory install, connect, skills install, passkeys, upgrade, or uninstall --apply.

Impact

Can create/delete the named Cloudflare resources or configure the selected client when explicitly requested.

Mechanism

User-invoked Cloudflare provisioning and MCP-client integration.

Rationale

Direct inspection shows the flagged process, network, filesystem, and agent-client operations are bounded to documented explicit commands. No install-time foreign control-surface mutation, credential exfiltration, remote payload execution, or stealth persistence was found.

Evidence

package.jsondist/npm-cli/scripts/cli.jsdist/npm-cli/scripts/setup.jsdist/npm-cli/scripts/client-tools.jsdist/npm-cli/scripts/uninstall.jsdist/npm-cli/scripts/passkeys.js

Network endpoints2

bootstrap.invalid127.0.0.1:45831/callback

wikimemory@0.2.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code