Skills/npm/agnoclast-mcp

agnoclast-mcp@0.9.337

CAUTION· startup only

Publisher claims: "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher theronap · publishing for 168 daysInstalls 22,889Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
CORTEX_TOKENConfiguration, not credentials: AGNOCLAST_CLIENT, AGNOCLAST_TURN_CHECK, BUG_REPORTS_PATH, CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID, CORTEX_AUTOFILE, CORTEX_CAPTURE_DETACHED, CORTEX_CAPTURE_SYNC, CORTEX_CLIENT_ROLE, CORTEX_HTTP_TIMEOUT_MS, CORTEX_REPORT_SPOOL_DIR, CORTEX_REVIEW_DISABLED, CORTEX_REVIEW_MODEL, CORTEX_SUMMARIZE_DISABLED, CORTEX_SUMMARIZING, CORTEX_SUMMARY_MODEL, CORTEX_SUMMARY_TIMEOUT_MS, CORTEX_SUMMARY_WINDOW, CORTEX_TYPED, CORTEX_URL, NEW_KEY, OLD_KEY
Where it talks to
no vendor host named in the codeAlso agnoclast.com, apple.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names agnoclast.com, apple.com as well as its own vendor. The guard injects CORTEX_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @theronap/agnoclast-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; HTTP URL with a raw public IP address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 24 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
4.0sprocessdependency install exit 0
24sfilesystemread ~/.cortex · ~/Library/LaunchAgents outside project
24sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-kMaOya/task/home/work/acme-api/.claude/skills/agnoclast-mcp/lib/server.mjs' } Node.js v22.23.4
24sprocessscript backend runs setup only
24sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathslib/edge_extract.mjs:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn { ...env, ...extra }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathslib/diagnose.mjs:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst env = cfg?.mcpServers?.[key]?.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
HTTP URL with a raw public IP addresslib/diagnose.mjs:601 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameconst REACHABILITY_URL = 'https://1.1.1.1/cdn-cgi/trace'Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathslib/diagnose.mjs:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst m = toml.match(new RegExp(`\\[mcp_servers\\.${key}\\.env\\][\\s\\S]*?${name}\\s*=\\s*"([^"]+)"`))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagelib/diagnose.mjs:811 · npx invocation of non-well-known package — may execute untrusted codemessage: 'No CORTEX_TOKEN found. Run: npx -y @theronap/agnoclast-mcp login (opens your browser; or `setup <token>` with a token from the console → Connect your AI)' } }Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/doctor.mjs:75 · npx invocation of non-well-known package — may execute untrusted codeout('Agnoclast: NOT connected — no token found. Run: npx -y @theronap/agnoclast-mcp login (opens your browser; or `setup <token>` with a token from the console → Connect your AI)')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:120 · npx invocation of non-well-known package — may execute untrusted code` uninstall remove ALL Agnoclast wiring (MCP, hooks, skills, launchd, cron). --dry-run to preview, --purge to also wipe ~/.cortex + npx cache\n` +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/channel.mjs:33 · npx invocation of non-well-known package — may execute untrusted codeexport const channelCommand = (channel) => `npx -y ${PKG}@latest channel ${channel}`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:362 · npx invocation of non-well-known package — may execute untrusted code// `PreCompact: npx -y @theronap/agnoclast-mcp@latest precompact` in ~/.claude/settings.json, and @latestFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:111 · npx invocation of non-well-known package — may execute untrusted code` npx -y @theronap/agnoclast-mcp login\n\n` +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/doctor.mjs:112 · npx invocation of non-well-known package — may execute untrusted codeout(`Agnoclast: NOT connected — ${r.diagnosis?.message ?? 'check failed'}. Run: npx -y @theronap/agnoclast-mcp doctor`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using a raw public IP addresslib/diagnose.mjs:601 · URL using a raw public IP address — may bypass domain-based filteringconst REACHABILITY_URL = 'https://1.1.1.1/cdn-cgi/trace'Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagelib/confidential_guard.mjs:18 · npx invocation of non-well-known package — may execute untrusted code// `node` on every MCP call, so it may import only Node built-ins (no npx start-up on the hot path).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandlib/custom_sources.mjs:142 · File permission modification command — agent changes file ownership/permissions… ` ${r.key}`, `Store it now, outside any repo: ${keyFileHint(c.slug)} (chmod 600), or an environment variable. Never commit it or paste it into a chat or a p…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathslib/file_capture.mjs:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestoken = s?.env?.CORTEX_TOKEN ?? nullFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagelib/editors/antigravity.mjs:12 · npx invocation of non-well-known package — may execute untrusted code// (npx @theronap/agnoclast-mcp antigravity-sync, or a published cortex-agent) — a prerequisite thisFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/doctor.mjs:24 · npx invocation of non-well-known package — may execute untrusted code// `npx @theronap/agnoclast-mcp doctor` — a live, one-command health check.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/channel.mjs:265 · npx invocation of non-well-known package — may execute untrusted codeprocess.stderr.write(`Usage: npx -y ${PKG}@latest channel [stable|latest]\n`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathslib/migrate_key.mjs:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst OLD = new Set([`[mcp_servers.${OLD_KEY}]`, `[mcp_servers.${OLD_KEY}.env]`])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:16 · npx invocation of non-well-known package — may execute untrusted code* npx -y @theronap/agnoclast-mcp setup <your-token>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/closeout.mjs:635 · npx invocation of non-well-known package — may execute untrusted codeconst command = `npx -y ${spec} closeout-sweep >> "${home}/.cortex/closeout/sweep.log" 2>&1`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/capture_status.mjs:24 · npx invocation of non-well-known package — may execute untrusted codecli: (source) => `npx -y @theronap/agnoclast-mcp use-brain "<brain>" --source ${source}`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cortex-mcp.mjs:174 · npx invocation of non-well-known package — may execute untrusted code// --dry-run prints the plan and changes nothing; --purge also removes ~/.cortex, the npx cache, andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:268 · npx invocation of non-well-known package — may execute untrusted codeconst captureCmd = markCommand(`npx -y ${spec} capture`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathslib/editors/codex.mjs:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* [mcp_servers.agnoclast] / [mcp_servers.cortex] tables (+ their .env) (so re-runs update in place rather thanFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathslib/file_capture.mjs:113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesbase = base ?? s?.env?.CORTEX_URL ?? nullFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathslib/with_token.mjs:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// TOKEN="$(node -e "…JSON.parse(…'/.claude.json')?.mcpServers?.cortex?.env?.CORTEX_TOKEN…")"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:17 · npx invocation of non-well-known package — may execute untrusted code// --purge also removes: ~/.cortex state dir, the npx cache, and every .cortex-bak backup.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:135 · npx invocation of non-well-known package — may execute untrusted codeconst captureCmd = `npx -y ${spec} capture`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:73 · npx invocation of non-well-known package — may execute untrusted code// pilot install). A tag is re-resolved by npx against the registry, so machines pick up promotedFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/editors/codex.mjs:28 · npx invocation of non-well-known package — may execute untrusted code'startup_timeout_sec = 60', // first npx fetch can be slow; don't time out the server on cold startFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:133 · npx invocation of non-well-known package — may execute untrusted codefor (const cache of npxCacheDirs()) { act(` - PURGE npx cache ${cache}`); if (!dry) rmSync(cache, { recursive: true, force: true }) }Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:294 · npx invocation of non-well-known package — may execute untrusted codeconst snapshotCmd = markCommand(`npx -y ${spec} snapshot-context`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:288 · npx invocation of non-well-known package — may execute untrusted codeconst skillsCmd = markCommand(`npx -y ${spec} skills --repair --quiet`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:130 · npx invocation of non-well-known package — may execute untrusted code// --purge: state dir + npx cache + backupsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:71 · npx invocation of non-well-known package — may execute untrusted code// Wire a moving dist-tag — NOT a frozen version. A bare spec lets npx reuse a stale cached build; aFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:43 · npx invocation of non-well-known package — may execute untrusted codereturn { error: `Usage: npx ${pkg} setup <CORTEX_TOKEN>\n\nGet your token from the Agnoclast console → Connect your AI.\n` }Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/uninstall.mjs:146 · npx invocation of non-well-known package — may execute untrusted codeprocess.stdout.write(' Full wipe (state dir + npx cache + backups too): add --purge\n\n')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/publish_targets.mjs:19 · npx invocation of non-well-known package — may execute untrusted code// itself. `npx -y <either name>` still works: with exactly one bin declared, npx runs it regardlessFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionlib/report_spool.mjs:168 · File type combined with upload action — agent may exfiltrate local data filesconst CLAIM_MARK = '.json.sending.'Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelib/use_brain.mjs:48 · npx invocation of non-well-known package — may execute untrusted codeout('Agnoclast: no token found. Run: npx -y @theronap/agnoclast-mcp login (opens your browser; or `setup <token>` with a token from the console → Connect your AI)')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionlib/redact.mjs:28 · File type combined with upload action — agent may exfiltrate local data files// config.toml, shell commands — the 2026-07-02 finding: a grep of hooks.json put the live tokenFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelib/setup.mjs:25 · npx invocation of non-well-known package — may execute untrusted code// spec lets npx reuse a stale cached build, a frozen @x.y.z strands the machine forever (theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction fileslib/rename_notice.mjs:29 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file+ `mcp__${NEW_KEY}__*. If your CLAUDE.md names the old tools, update it when convenient. `Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionlib/report_spool.mjs:167 · File type combined with upload action — agent may exfiltrate local data files// repeat of the same failure lands in a FRESH <key>.json, so nothing spooled mid-send is lost or re-sent.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:279 · npx invocation of non-well-known package — may execute untrusted codeconst statusCmd = markCommand(`npx -y ${spec} status`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/install.mjs:80 · npx invocation of non-well-known package — may execute untrusted code'Usage: npx @theronap/agnoclast-mcp install [<CORTEX_TOKEN>] [--editor auto|all|<id,...>]\n\n' +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/file_capture.mjs:29 · npx invocation of non-well-known package — may execute untrusted code// `node` after every Write / Edit / Read, so it may import only Node built-ins (no npx start-up on the hot path).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/editors/codex.mjs:101 · npx invocation of non-well-known package — may execute untrusted codeconst captureCmd = `npx -y ${spec} capture`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/editors/claude.mjs:347 · npx invocation of non-well-known package — may execute untrusted code// npx resolves a semver range (verified 2026-09-21 against a real invocation, not assumed).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/managed.mjs:30 · npx invocation of non-well-known package — may execute untrusted code* early Stop-hook command that predates the npx form. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/rename_notice.mjs:30 · npx invocation of non-well-known package — may execute untrusted code+ `Run \`npx -y @theronap/agnoclast-mcp migrate-key\` to switch now, or wait and it will happen for you.`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈66 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @theronap/agnoclast-mcp@0.9.337 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim theronap: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. HTTP URL with a raw public IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. URL using a raw public IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim theronapPropose a patch to the maintainer