neuromcp

Risky

Score 52 / 100 · 80 files read · 0 critical, 0 high, 24 medium, 19 low findings

Report 6cb68eff64eb6cdf · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials62

exfiltration92

execution4

injection100

obfuscation100

files12

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumCan run shell commands from code

bin/daemon-port.mjs · line 15 · rule M1

leSync } from 'node:child_process'; import { existsSync } from 'node:fs'; import { resolve } from 'node:path'; import { homedir, p

mediumCan run shell commands from code

bin/doctor.mjs · line 21 · rule M1

spawn } from 'node:child_process'; import { readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs'; import { creat

mediumWrites files under the user home directory

bin/doctor.mjs · line 22 · rule M5

ort { readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs'; import { createHash } from 'node:crypto'; import { cr

mediumCan run shell commands from code

bin/enable-consolidation.mjs · line 25 · rule M1

leSync } from 'node:child_process'; import { fileURLToPath } from 'node:url'; const __dirname = dirname(fileURLToPath(import.meta

mediumWrites files under the user home directory

bin/enable-consolidation.mjs · line 22 · rule M5

Sync, readFileSync, writeFileSync, unlinkSync } from 'node:fs'; import { join, dirname } from 'node:path'; import { homedir, platf

mediumCan run shell commands from code

bin/enable-daemon.mjs · line 38 · rule M1

leSync } from 'node:child_process'; import { fileURLToPath } from 'node:url'; import { resolveStableNodeBin } from './resolve-node

mediumWrites files under the user home directory

bin/enable-daemon.mjs · line 35 · rule M5

Sync, readFileSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs'; import { join, dirname } from 'node:path'; import { hom

mediumCan run shell commands from code

bin/enable-zombie-cleanup.mjs · line 36 · rule M1

leSync } from 'node:child_process'; import { fileURLToPath } from 'node:url'; const __dirname = dirname(fileURLToPath(import.meta

mediumWrites files under the user home directory

bin/enable-zombie-cleanup.mjs · line 33 · rule M5

Sync, readFileSync, writeFileSync, unlinkSync } from 'node:fs'; import { join, dirname } from 'node:path'; import { homedir, platf

mediumCan run shell commands from code

bin/init-wiki.mjs · line 22 · rule M1

leSync } from 'node:child_process'; import { createHash } from 'node:crypto'; import { fileURLToPath } from 'node:url'; import { s

mediumWrites files under the user home directory

bin/init-wiki.mjs · line 19 · rule M5

Sync, readFileSync, writeFileSync } from 'node:fs'; import { join, dirname } from 'node:path'; import { homedir, platform } from '

mediumCan run shell commands from code

bin/init.mjs · line 41 · rule M1

leSync } from 'node:child_process'; import { fileURLToPath } from 'node:url'; import { isMainModule } from './is-main.mjs'; import

mediumWrites files under the user home directory

bin/init.mjs · line 30 · rule M5

s fsReadFileSync, writeFileSync as fsWriteFileSync, copyFileSync as fsCopyFileSync, mkdirSync as fsMkdirSync, renameSync a

mediumCan run shell commands from code

bin/neuromcp-connect.mjs · line 31 · rule M1

*/ import { spawn, execFile } from 'node:child_process'; import { platform } from 'node:os'; import { isMainModule } from './is-m

mediumCan run shell commands from code

bin/reembed.mjs · line 30 · rule M1

leSync } from 'node:child_process'; import { existsSync, renameSync, unlinkSync } from 'node:fs'; import { resolve, dirname } from

mediumRuns a command automatically at install time (postinstall)

package.json · line 1 · rule M4

postinstall: node scripts/download-model.mjs || true

mediumWrites files under the user home directory

scripts/ab-sweep.mjs · line 24 · rule M5

stsSync, mkdirSync, writeFileSync } from 'node:fs'; import { join } from 'node:path'; import { homedir } from 'node:os'; import Da

mediumCan run shell commands from code

scripts/consolidate-sessions.py · line 253 · rule M1

days=2) r = subprocess.run( ["git", "-C", str(repo), "log", "--all", f"--since={first:%Y-%m-%d}", f"--until={l

mediumWrites files under the user home directory

scripts/consolidate-sessions.py · line 1008 · rule M5

with log_path.open("a") as f: f.write(f"\n## [{datetime.now().strftime('%Y-%m-%d')}] consolidation | auto\n"

mediumWrites files under the user home directory

scripts/download-model.mjs · line 21 · rule M5

irSync, existsSync, createWriteStream, renameSync, unlinkSync, accessSync, constants } from 'node:fs'; import { resolve, dirname }

mediumCan run shell commands from code

scripts/gen-hook-hashes.mjs · line 19 · rule M1

leSync } from 'node:child_process'; import { createHash } from 'node:crypto'; import { existsSync, readFileSync, writeFileSync } f

mediumWrites files under the user home directory

scripts/usefulness-dashboard.mjs · line 24 · rule M5

stsSync, mkdirSync, writeFileSync } from 'node:fs'; import { join } from 'node:path'; import { homedir } from 'node:os'; import Da

mediumWrites files under the user home directory

scripts/wiki-obsidian-bridge.mjs · line 27 · rule M5

Sync, readFileSync, writeFileSync, statSync, existsSync } from 'node:fs'; import { join } from 'node:path'; import { homedir } fro