Skills/npm/codebase-memory-mcp

codebase-memory-mcp@0.12.1

VERIFIED

Publisher claims: "Fast code intelligence for AI coding agents — installs a verified native runtime set" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher deusdata · joined 0 days agoInstalls 36,494Last detonated 58 min ago

$claude mcp add codebase-memory-mcp -- npx -y codebase-memory-mcp

Report an issue

Behavior trace

Honeypot run · 9 s · 2 scenarios · 0 deviations

t+CategoryObserved action

5.1sprocessexec /app/apps/web/node_modules/.bin/tar

5.1sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/tar

5.1sprocessexec /app/node_modules/.bin/tar

5.1sprocessexec /pnpm/tar

5.1sprocessexec /usr/local/sbin/tar

5.1sprocessexec /usr/local/bin/tar

5.1sprocessexec /usr/sbin/tar

5.1sprocessexec /usr/bin/tar

5.1sprocessexec /app/apps/web/node_modules/.bin/gzip

5.1sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/gzip

5.1sprocessexec /app/node_modules/.bin/gzip

5.1sprocessexec /pnpm/gzip

5.1sprocessexec /usr/local/sbin/gzip

5.1sprocessexec /usr/local/bin/gzip

5.1sprocessexec /usr/sbin/gzip

5.1sprocessexec /usr/bin/gzip

5.1sprocessexec /tmp/cbm-install-zurE6D/codebase-memory-mcp

5.1sprocessexec /tmp/ks-detonate-AvfIYq/setup/home/work/acme-api/.claude/skills/codebase-memory-mcp/bin/.codebase-memory-mcp.1782.9f2751c0d68e0f88.tmp

5.1sprocessexec /tmp/ks-detonate-AvfIYq/setup/home/work/acme-api/.claude/skills/codebase-memory-mcp/bin/codebase-memory-mcp

5.2sprocessexec /tmp/ks-detonate-AvfIYq/setup/home/work/acme-api/.claude/skills/codebase-memory-mcp/bin/codebase-memory-mcp

9.4sprocessexec /usr/bin/timeout

9.4sprocessexec /app/apps/web/node_modules/.bin/tar

9.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/tar

9.4sprocessexec /app/node_modules/.bin/tar

9.4sprocessexec /pnpm/tar

9.4sprocessexec /usr/local/sbin/tar

9.4sprocessexec /usr/local/bin/tar

9.4sprocessexec /usr/sbin/tar

9.4sprocessexec /usr/bin/tar

9.4sprocessexec /app/apps/web/node_modules/.bin/gzip

9.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/gzip

9.4sprocessexec /app/node_modules/.bin/gzip

9.4sprocessexec /pnpm/gzip

9.4sprocessexec /usr/local/sbin/gzip

9.4sprocessexec /usr/local/bin/gzip

9.4sprocessexec /usr/sbin/gzip

9.4sprocessexec /usr/bin/gzip

9.4sprocessexec /tmp/cbm-install-47h3fS/codebase-memory-mcp

9.4sprocessexec /tmp/ks-detonate-AvfIYq/task/home/work/acme-api/.claude/skills/codebase-memory-mcp/bin/.codebase-memory-mcp.1826.b23be92b8d00a53e.tmp

9.4sprocessexec /tmp/ks-detonate-AvfIYq/task/home/work/acme-api/.claude/skills/codebase-memory-mcp/bin/codebase-memory-mcp

9.4sprocessexited 1: codebase-memory-mcp: could not load saved runtime settings

9.4sclaimedno tools/list reply (exit 1)

9.4sprocessscript backend runs setup only

Static findings

LOW

Unpinned dependencyinstall.js:825 · Unpinned dependency

AST06

LOW

Unpinned dependencybin.js:71 · Unpinned dependency

AST06

HIGH

npx invocation of non-well-known packageinstall.js:823 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Access to sensitive file pathsREADME.md:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05