Notes 9
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Persistence
mediumNoteConfirmed on reviewhigh confidenceThe README gives a block the user may paste into AGENTS.md, copilot-instructions, or .cursor/rules so their agent learns BriefGate; the user copies it manually, so it is a note.
add this block to your `AGENTS.md`, `.github/copilot-instructions.md`, or `.cursor/rules`:
vector:instruction
Reviewer's reasoning
The block is a documented snippet the user pastes manually into their own instruction file, a user-invoked step; the harm needs the user to act, so it stays a note.
Credential access
mediumNoteConfirmed on reviewhigh confidenceThe README has the user add the BriefGate API key in plaintext to ~/.claude/settings.json; this is a user-invoked credential hygiene step, so it is a note.
Or add manually to `~/.claude/settings.json`:
vector:instruction
Reviewer's reasoning
The README tells the user to add their own API key to their own settings file, a user-invoked configuration step for the service the key belongs to; this is credential hygiene, not exfiltration.
Persistence
mediumNoteConfirmed on reviewhigh confidenceThe README tells the user to add an MCP server entry to .cursor/mcp.json; this is a user-invoked configuration step that is declared, so it is a note.
**Cursor** — add to `.cursor/mcp.json`:
vector:instruction
Reviewer's reasoning
The Cursor MCP entry is a declared configuration step the user performs by hand, so it is a note.
Data exfiltration
mediumNoteConfirmed on reviewlow confidenceThe privacy section says the package sends nothing except to api.briefgate.dev and writes no telemetry, while the artifact's own network call to that publisher-owned API is a declared feature, so the telemetry denial misstates a note-level behavior.
It writes no telemetry and no analytics.
Reviewer's reasoning
The telemetry denial is a misstatement, but the behavior it misdescribes (a call to the publisher's own API using the user's key) is a declared note-level behavior, so the claim is a note.
Credential access
mediumNoteConfirmed on reviewhigh confidenceThe plugin stores the user's live BriefGate API key in plaintext JSON under the home directory after login; the publisher's own credential store is declared and permissions are restricted, so this is a hygiene note only.
file/dir permissions are forced to 600/700 because this file
vector:code
Reviewer's reasoning
The publisher's own credential store is declared and its file permissions are restricted to the owner, so this is a hygiene note only.
Data exfiltration
mediumNoteConfirmed on reviewlow confidenceThe operator-set BRIEFGATE_BASE_URL environment variable decides the host that receives the BriefGate API key in the Authorization header; a non-https host only triggers a stderr warning, so the destination is controlled by whoever configures the process.
(including the Authorization header) are sent
vector:code
Reviewer's reasoning
BRIEFGATE_BASE_URL is operator-set configuration, and the artifact warns on non-https hosts; the destination is chosen by whoever configures the process, which is a note.
Destructive action
mediumNoteConfirmed on reviewmedium confidenceThe update_item tool description tells the agent to repeat the call with discard_submitted_value true, which erases a client's already-submitted answer; this is declared and gated behind a failed call, so it is a note.
Repeat it with discard_submitted_value: true to clear the answer and ask them again.
vector:metadata
Reviewer's reasoning
The discard is the declared job of an edit tool with destructiveHint set, and the description gates it behind a failed call that reports the conflict; this is a note, though the agent does repeat without a fresh confirmation.
Supply chain
lowNoteConfirmed on reviewmedium confidenceThe MCPB bundle packages the publisher's own @briefgate/mcp package for a one-click Claude Desktop install that prompts for an optional API key at install time, which is a note-level supply surface from the publisher's own package.
`@briefgate/mcp` package as a one-click Claude Desktop install
vector:instruction
Reviewer's reasoning
The MCPB bundle packages the publisher's own package and asks for an optional key at install time, a declared install path for the publisher's own code, so it is a supply-surface note.
Agent hijacking
lowNoteConfirmed on reviewlow confidenceThe collect-from-client workflow tells the agent to send emails to an outside client through define_intake and start automatic chasing before the user confirms, a consequential step taken on the user's account, which is a low-confidence note under the declared purpose.
This emails the client a
vector:instruction
Reviewer's reasoning
Emailing the client through define_intake is the skill's declared core purpose, requested as part of the user's workflow; no evidence shows the step bypasses a prompt the user was owed, so it is a note.
