Optional diagnostics MCP server for OpenReflex's ambient project muscle memory.
Risky behavior the analysis could not rule out.
. Suspiciousplugins/openreflex Suspiciousplugins/openreflex/skills/openreflex No issues foundThe opt-in `tokens enable` path writes OTEL telemetry env entries into the user's global ~/.claude/settings.json (agent control-plane config); this is documented as optional token accounting and does not break the read-only claim, which applies to the no-argument /openreflex command.
_atomic_json(_settings_path(), settings)
At SessionStart the launcher creates a venv under ~/.openreflex and pip-installs a package from PyPI by default, or from an arbitrary spec in the OPENREFLEX_BOOTSTRAP_SPEC env var, then runs it for every hook with the full process environment and stdin.
const spec = process.env.OPENREFLEX_BOOTSTRAP_SPEC || ("openreflex==" + expectedVersion);The default is a pinned PyPI install, but the install spec can be overridden through the undeclared OPENREFLEX_BOOTSTRAP_SPEC env var. The override flows straight into pip install, and the resulting runtime receives every hook's stdin and environment.
The Cursor hook config runs a bare `openreflex` resolved from PATH, contradicting the launcher's stated policy that the plugin never executes an arbitrary openreflex from PATH, so a PATH shim would receive hook data.
"command": "openreflex hook cursor sessionStart"
What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
install_diagnostics writes an openreflex MCP server entry (command openreflex, args mcp) into the project's .mcp.json, an opt-in agent MCP configuration write.
mcp = project / ".mcp.json"
This is the explicitly opt-in MCP diagnostics installer that writes an MCP entry into the project's .mcp.json. The detector contradiction concerns the read-only claim for the no-argument /openreflex command, not this installer.
The SessionStart hook automatically runs a launcher that bootstraps a Python runtime by downloading and installing a PyPI package, which is then executed on every hook event; the package contents are not shipped for review.
node \"${CLAUDE_PLUGIN_ROOT}/runtime/launcher.cjs\" hook claude-code SessionStart --plugin-root \"${CLAUDE_PLUGIN_ROOT}\"The hook is the plugin's own launcher. The runtime it installs is a version-pinned PyPI package matching the plugin manifest version, and the launcher verifies the installed version afterward. That falls under the pinned official-registry install carve-out.
The plugin ships only a launcher; at SessionStart it creates a venv and pip-installs the actual runtime (openreflex==version, overridable via the OPENREFLEX_BOOTSTRAP_SPEC env var) from a remote index, so the code that receives all hook input is fetched at runtime and is not part of the reviewed artifact.
["-m", "pip", "install", "--disable-pip-version-check", "--quiet", "--upgrade", spec],
The default install is a version-pinned package from the official registry, and the launcher verifies the installed version afterward. That is the accepted pinned-registry carve-out, and the remote runtime is the project's own published package.
configure_statusline writes a command-type statusLine, whose command can be taken from env OPENREFLEX_RUNTIME_COMMAND, into the user-level Claude settings.json, so that command re-executes every refresh in the user scope outside the project.
data["statusLine"] = {"type": "command", "command": desired, "padding": 0, "refreshInterval": 2}The user-level statusLine write is the declared OpenReflex status line feature, it preserves user-owned entries, and the env-supplied command is set by the plugin runtime itself. No attacker-controlled chain is shown.
configure_statusline writes an OpenReflex-owned statusLine command into the user-level Claude settings.json (agent control-plane write), invoked from session hooks without per-call confirmation; it is consistent with the declared Claude status line feature and preserves existing non-owned entries.
data["statusLine"] = {"type": "command", "command": desired, "padding": 0, "refreshInterval": 2}The finding itself calls this consistent with the declared status line feature. The write is documented and preserves existing non-owned entries.
The onboard command (and install/hook paths) calls configure_statusline, which writes a managed OpenReflex statusline into the user-scope Claude settings, an agent control-plane write beyond what an MCP memory server strictly needs; it is disclosed and preserves existing user statuslines.
status = configure_statusline(project)
The onboard command is explicit user onboarding. It discloses the statusline behavior and preserves an existing user status line.
The tokens enable action modifies Claude Code telemetry settings and starts a local loopback receiver, a control-plane configuration change that is user-invoked and disclosed as counts-only.
result = enable()
This is an explicit user-invoked opt-in command whose help text discloses the loopback receiver, and it refuses to overwrite conflicting user telemetry settings. It is a declared core capability.
The installer merges hook commands (openreflex hook ...) into the project's .claude/settings.json and auto-approves the project, so these hooks run on every agent lifecycle event; this is the declared installer purpose but is an agent control-plane write.
settings = project / ".claude" / "settings.json"
Merging hooks into the project's settings.json is the declared purpose of the explicit install command, which has a dry-run option and a matching uninstall.
ensure_receiver spawns a detached background Python process (new session, stdio discarded) that serves a loopback HTTP receiver; the README discloses a loopback-only OpenReflex receiver for opt-in token accounting.
subprocess.Popen(command, **kwargs)
The detached process runs a fixed local command to serve the loopback receiver. It is part of the opt-in, disclosed token accounting feature and can be stopped with disable.
The opt-in `tokens enable` command writes OpenTelemetry env keys into the user-level Claude settings.json and starts a detached loopback receiver, which changes Claude's telemetry configuration persistently, though only to a loopback endpoint with content logging disabled.
env.update(OWNED_ENV)
The write is an opt-in, user-invoked, disclosed token accounting feature. It sets only loopback telemetry keys it owns and aborts on conflicting user settings.
Parts of the artifact the static analysis could not fully examine.
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources