Refuted findings 5
Candidates the review stage examined and rejected, kept for transparency.
Supply chain
criticalRefutedmedium confidenceThe install guide directs the agent to run the unpinned `npx -y code-relay-mcp@latest`, which fetches and executes whatever npm currently publishes, although it requires a preview and user confirmation before applying changes.
npx -y code-relay-mcp@latest install --client codex
Why it was refuted
This is the package's own installer command in fenced install docs, and the docs require a no-`--yes` preview and user confirmation before any change is applied. It matches the vendor-installer carve-out, and the installer pins the resolved version afterwards.
Persistence
criticalRefutedlow confidenceThe installer, with --yes, writes the code-relay server entry into agent MCP config files (.mcp.json, .cursor/mcp.json, .vscode/mcp.json). It merges with the existing file, keeps a backup, and previews first, so this is a documented control-plane write that makes npx launch the package.
fs.renameSync(temporary, target.file);
Why it was refuted
The config write is the declared installer function: it previews first, merges into the existing object, refuses to overwrite invalid JSON, backs up the old file, and writes only with --yes after confirmation. The docs describe this write, so it is not undeclared and the D23 contradiction is a false positive.
Supply chain
criticalRefutedmedium confidenceThe npm launcher downloads a native executable from a GitHub release URL at first run, validates it only against a SHA256SUMS file fetched from the same origin, writes it to the cache with mode 0700, and executes it, so a compromised release would run arbitrary code.
const binary = await requestBuffer(`${baseUrl}/${asset}`, 100 * 1024 * 1024);Why it was refuted
The download-and-run of the project's own release binary is the declared core function of the launcher. The version is validated, the download is announced, and the SHA256 check throws on mismatch before the file is written and made executable.
Code execution
highRefutedlow confidenceThe CODE_RELAY_AGENT_PATH environment variable makes the launcher skip download and checksum verification and run any file at that path as the MCP server binary.
if (process.env.CODE_RELAY_AGENT_PATH) {Why it was refuted
CODE_RELAY_AGENT_PATH is a local, operator-set environment override for the launcher's own native binary and requires the path to be an existing file. No agent instruction or remote source sets it, and whoever controls the process environment already has execution.
Supply chain
highRefutedlow confidenceThe launcher downloads a native binary at first run from a GitHub release URL and verifies it only against a SHA256SUMS file fetched from the same origin (documented), with env/option overrides (CODE_RELAY_AGENT_PATH, baseUrl) that can redirect execution.
https://github.com/zarcherlot/code-relay/releases/download/v${version}Why it was refuted
Fetching the project's own version-pinned release binary is the launcher's core capability. The code announces the download and verifies a SHA256 checksum before installing, and the baseUrl override is a programmatic option rather than something an agent is told to set.
