agnoclast-mcp@0.9.320
CAUTION· not startedPublisher claims: "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher theronap · publishing for 168 daysInstalls 22,889Last detonated 8d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
Code inventory arrives with this version's next honeypot run.- It will ask for
- unknown until the next run
- Where it talks to
- unknown until the next run
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try agnoclast-mcp` runs it now and prints the full answer.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-07 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 1 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
0.8sprocessdependency install exit 1
0.8sfilesystemread ~/.cortex · ~/Library/LaunchAgents outside project
0.8sprocessexec /usr/bin/date
0.8sprocessexec /usr/bin/timeout
0.8sclaimedno tools/list reply (exit 0)
0.9sprocessscript backend runs setup only
0.9sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:362 · npx invocation of non-well-known package — may execute untrusted code
AST06// `PreCompact: npx -y @theronap/agnoclast-mcp@latest precompact` in ~/.claude/settings.json, and @latestFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathslib/editors/codex.mjs:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* [mcp_servers.agnoclast] / [mcp_servers.cortex] tables (+ their .env) (so re-runs update in place rather thanFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:16 · npx invocation of non-well-known package — may execute untrusted code
AST06* npx -y @theronap/agnoclast-mcp setup <your-token>Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathslib/diagnose.mjs:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const env = cfg?.mcpServers?.[key]?.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathslib/with_token.mjs:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// TOKEN="$(node -e "…JSON.parse(…'/.claude.json')?.mcpServers?.cortex?.env?.CORTEX_TOKEN…")"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Outbound HTTP to raw IP addresslib/diagnose.mjs:594 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07const REACHABILITY_URL = 'https://1.1.1.1/cdn-cgi/trace'Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:111 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y @theronap/agnoclast-mcp login\n\n` +Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathslib/file_capture.mjs:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05token = s?.env?.CORTEX_TOKEN ?? nullFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathslib/migrate_key.mjs:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const OLD = new Set([`[mcp_servers.${OLD_KEY}]`, `[mcp_servers.${OLD_KEY}.env]`])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathslib/file_capture.mjs:113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05base = base ?? s?.env?.CORTEX_URL ?? nullFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:174 · npx invocation of non-well-known package — may execute untrusted code
AST06// --dry-run prints the plan and changes nothing; --purge also removes ~/.cortex, the npx cache, andFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:120 · npx invocation of non-well-known package — may execute untrusted code
AST06` uninstall remove ALL Agnoclast wiring (MCP, hooks, skills, launchd, cron). --dry-run to preview, --purge to also wipe ~/.cortex + npx cache\n` +Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathslib/diagnose.mjs:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const m = toml.match(new RegExp(`\\[mcp_servers\\.${key}\\.env\\][\\s\\S]*?${name}\\s*=\\s*"([^"]+)"`))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathslib/edge_extract.mjs:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return { ...env, ...extra }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagelib/publish_targets.mjs:19 · npx invocation of non-well-known package — may execute untrusted code
AST06// itself. `npx -y <either name>` still works: with exactly one bin declared, npx runs it regardlessFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/managed.mjs:30 · npx invocation of non-well-known package — may execute untrusted code
AST06* early Stop-hook command that predates the npx form. */Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:288 · npx invocation of non-well-known package — may execute untrusted code
AST06const skillsCmd = markCommand(`npx -y ${spec} skills --repair --quiet`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/capture_status.mjs:24 · npx invocation of non-well-known package — may execute untrusted code
AST06cli: (source) => `npx -y @theronap/agnoclast-mcp use-brain "<brain>" --source ${source}`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/doctor.mjs:112 · npx invocation of non-well-known package — may execute untrusted code
AST06out(`Agnoclast: NOT connected — ${r.diagnosis?.message ?? 'check failed'}. Run: npx -y @theronap/agnoclast-mcp doctor`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/rename_notice.mjs:30 · npx invocation of non-well-known package — may execute untrusted code
AST06+ `Run \`npx -y @theronap/agnoclast-mcp migrate-key\` to switch now, or wait and it will happen for you.`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:268 · npx invocation of non-well-known package — may execute untrusted code
AST06const captureCmd = markCommand(`npx -y ${spec} capture`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:347 · npx invocation of non-well-known package — may execute untrusted code
AST06// npx resolves a semver range (verified 2026-09-21 against a real invocation, not assumed).Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/editors/codex.mjs:101 · npx invocation of non-well-known package — may execute untrusted code
AST06const captureCmd = `npx -y ${spec} capture`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/diagnose.mjs:804 · npx invocation of non-well-known package — may execute untrusted code
AST06message: 'No CORTEX_TOKEN found. Run: npx -y @theronap/agnoclast-mcp login (opens your browser; or `setup <token>` with a token from the console → Connect your AI)' } }Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/file_capture.mjs:29 · npx invocation of non-well-known package — may execute untrusted code
AST06// `node` after every Write / Edit / Read, so it may import only Node built-ins (no npx start-up on the hot path).Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/install.mjs:80 · npx invocation of non-well-known package — may execute untrusted code
AST06'Usage: npx @theronap/agnoclast-mcp install [<CORTEX_TOKEN>] [--editor auto|all|<id,...>]\n\n' +Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/editors/antigravity.mjs:12 · npx invocation of non-well-known package — may execute untrusted code
AST06// (npx @theronap/agnoclast-mcp antigravity-sync, or a published cortex-agent) — a prerequisite thisFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/closeout.mjs:635 · npx invocation of non-well-known package — may execute untrusted code
AST06const command = `npx -y ${spec} closeout-sweep >> "${home}/.cortex/closeout/sweep.log" 2>&1`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/confidential_guard.mjs:18 · npx invocation of non-well-known package — may execute untrusted code
AST06// `node` on every MCP call, so it may import only Node built-ins (no npx start-up on the hot path).Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
URL using raw IP addresslib/diagnose.mjs:594 · URL using raw IP address — may bypass domain-based filtering
AST07const REACHABILITY_URL = 'https://1.1.1.1/cdn-cgi/trace'Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File permission modification commandlib/custom_sources.mjs:142 · File permission modification command — agent changes file ownership/permissions
AST05`Store it now, outside any repo: ${keyFileHint(c.slug)} (chmod 600), or an environment variable. Never commit it or paste it into a chat or a page. It can only ADD items to this one source; if it leakFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actionlib/report_spool.mjs:167 · File type combined with upload action — agent may exfiltrate local data files
AST07// repeat of the same failure lands in a FRESH <key>.json, so nothing spooled mid-send is lost or re-sent.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagelib/doctor.mjs:24 · npx invocation of non-well-known package — may execute untrusted code
AST06// `npx @theronap/agnoclast-mcp doctor` — a live, one-command health check.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/doctor.mjs:75 · npx invocation of non-well-known package — may execute untrusted code
AST06out('Agnoclast: NOT connected — no token found. Run: npx -y @theronap/agnoclast-mcp login (opens your browser; or `setup <token>` with a token from the console → Connect your AI)')Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/channel.mjs:265 · npx invocation of non-well-known package — may execute untrusted code
AST06process.stderr.write(`Usage: npx -y ${PKG}@latest channel [stable|latest]\n`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionlib/redact.mjs:28 · File type combined with upload action — agent may exfiltrate local data files
AST07// config.toml, shell commands — the 2026-07-02 finding: a grep of hooks.json put the live tokenFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagelib/editors/codex.mjs:28 · npx invocation of non-well-known package — may execute untrusted code
AST06'startup_timeout_sec = 60', // first npx fetch can be slow; don't time out the server on cold startFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/channel.mjs:33 · npx invocation of non-well-known package — may execute untrusted code
AST06export const channelCommand = (channel) => `npx -y ${PKG}@latest channel ${channel}`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:279 · npx invocation of non-well-known package — may execute untrusted code
AST06const statusCmd = markCommand(`npx -y ${spec} status`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:294 · npx invocation of non-well-known package — may execute untrusted code
AST06const snapshotCmd = markCommand(`npx -y ${spec} snapshot-context`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:73 · npx invocation of non-well-known package — may execute untrusted code
AST06// pilot install). A tag is re-resolved by npx against the registry, so machines pick up promotedFix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction fileslib/rename_notice.mjs:29 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01+ `mcp__${NEW_KEY}__*. If your CLAUDE.md names the old tools, update it when convenient. `Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:133 · npx invocation of non-well-known package — may execute untrusted code
AST06for (const cache of npxCacheDirs()) { act(` - PURGE npx cache ${cache}`); if (!dry) rmSync(cache, { recursive: true, force: true }) }Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:135 · npx invocation of non-well-known package — may execute untrusted code
AST06const captureCmd = `npx -y ${spec} capture`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:17 · npx invocation of non-well-known package — may execute untrusted code
AST06// --purge also removes: ~/.cortex state dir, the npx cache, and every .cortex-bak backup.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/use_brain.mjs:48 · npx invocation of non-well-known package — may execute untrusted code
AST06out('Agnoclast: no token found. Run: npx -y @theronap/agnoclast-mcp login (opens your browser; or `setup <token>` with a token from the console → Connect your AI)')Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:130 · npx invocation of non-well-known package — may execute untrusted code
AST06// --purge: state dir + npx cache + backupsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:71 · npx invocation of non-well-known package — may execute untrusted code
AST06// Wire a moving dist-tag — NOT a frozen version. A bare spec lets npx reuse a stale cached build; aFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:146 · npx invocation of non-well-known package — may execute untrusted code
AST06process.stdout.write(' Full wipe (state dir + npx cache + backups too): add --purge\n\n')Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:43 · npx invocation of non-well-known package — may execute untrusted code
AST06return { error: `Usage: npx ${pkg} setup <CORTEX_TOKEN>\n\nGet your token from the Agnoclast console → Connect your AI.\n` }Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionlib/report_spool.mjs:168 · File type combined with upload action — agent may exfiltrate local data files
AST07const CLAIM_MARK = '.json.sending.'Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:25 · npx invocation of non-well-known package — may execute untrusted code
AST06// spec lets npx reuse a stale cached build, a frozen @x.y.z strands the machine forever (theFix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈66 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @theronap/agnoclast-mcp@0.9.320 as of 8d ago. This is the package itself, not its dependencies.
What would make this Verified
11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim theronap: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim theronapPropose a patch to the maintainer