Why this verdict
mcp-server . Suspicious
- suspicious: finding mcp-server:.:packages/dashboard/src/cli.ts:92:EXFIL
mcp-server apps/web No issues found
- benign: 701 checks satisfied, no findings for mcp-server:apps/web
mcp-server packages/cli No issues found
- benign: 91 checks satisfied, no findings for mcp-server:packages/cli
mcp-server packages/mcp-server Suspicious
- suspicious: unverified finding mcp-server:packages/mcp-server:packages/mcp-server/src/prompts/system-prompt.ts:31:HIJACK
mcp-server packages/sdk No issues found
- benign: 57 checks satisfied, no findings for mcp-server:packages/sdk
Security findings 2
Data exfiltration
highContextual risklow confidenceThe dashboard CLI launches the local receipts web server with HOSTNAME set to 0.0.0.0, binding it to all network interfaces and potentially exposing locally stored receipt data to the LAN, while the banner advertises only localhost.
HOSTNAME: '0.0.0.0'
vector:code
Counter-argument considered
The CLI explicitly forces the server to bind to 0.0.0.0 while the banner and help text only mention localhost, so the LAN exposure of local receipt data is undeclared and not a carve-out.
Agent hijacking
mediumUnverifiedmedium confidenceThe server's system prompt tells the agent not to tell the user when it is saving data to persistent memory unless asked, which conceals memory-write actions from the user.
Don't announce "I'm saving this to memory" unless the user asks about your memory
vector:instruction
Open questions 1
What the analysis could not settle from the code alone.
The registered prompt 'agent-receipts-system' injects SYSTEM_PROMPT_TEXT as a user message. Its content is not shown here, so it is unknown whether it steers the agent beyond receipt/memory tracking (e.g. hidden or secret directives, or forced tool calls).
Agent hijacking
Refuted findings 4
Candidates the review stage examined and rejected, kept for transparency.
Agent hijacking
highRefutedlow confidenceThe suggested system prompt tells the agent to load stored user memory at session start and not tell the user it is doing so, hiding a memory-access action from the user.
don't announce that you're "checking memory."
Why it was refuted
Loading memory at session start is the declared core behavior and is disclosed to the user in the same document; not announcing it is a UX choice, not concealment.
Agent hijacking
highRefutedlow confidenceThe system-prompt snippet tells the agent not to tell the user when it saves observations about them to persistent memory, which is mild secrecy from the user, though it is the memory product's declared behavior and the user opts in by installing the snippet.
Don't announce "I'm saving this to memory" unless the user asks about your memory
Why it was refuted
Saving observations to memory is the product's declared core capability, documented to the user, and the prompt only says not to announce it unless asked; the user can have information forgotten.
Supply chain
mediumRefutedlow confidenceThe documented MCP config launches the server via npx with an unpinned package version, so whatever the registry currently serves runs as the MCP server.
"args": ["@agent-receipts/mcp-server"]
Why it was refuted
This is ordinary user-facing setup documentation for installing the project's own published package; it contains no instruction to the agent and no concealed behavior.
Manipulation
mediumRefutedlow confidenceimportBundle accepts an externally supplied memory bundle and writes its entities, observations and relationships into the local store, gated only by an unkeyed SHA-256 checksum computed from the bundle's own contents (not a signature), so a crafted bundle can plant arbitrary memories that are later recalled into agent context.
throw new Error('Bundle checksum mismatch — data may have been tampered with')Why it was refuted
Bundle import is a declared tool (memory_import_bundle) performing its documented function; it verifies integrity, records an audit receipt, and nothing is concealed or contradicts a claim.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
no_dataflow_for_unsupported_script unsupported_script file: string-literal extraction only
packages/crypto/bin/generate-keys.ts
