Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, the clock moved a year ahead, a GitHub Actions environment and an AI agent using it. It contacted registry.npmjs.org. It read some credential files, but nothing it sent carried them.

2 findings. Scanned 25 Oct 2026 by detonator 0.5.1.

Target: @modelcontextprotocol/server-memory
Source: npm 1.0.0
SHA-256: 8a97161b66a3a442
Files: -

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

Findings

F01 Low

Network destinations contacted

Confidence: Info The package connected to these hosts.
Observed in: mcp:baseline

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

registry.npmjs.org

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

F02 Low

A tool read its own credentials (e.g. gh, aws, ssh)

Confidence: Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
Observed in: mcp:baseline

Description

A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.

Impact

None in itself: this is how those tools work. Listed so the report shows every credential access.

Evidence

~/.npmrc (by npm)

Remediation

No action needed.

Exploration log

4 runs

mcp:baseline ok · 9.7s

new behavior: dns:registry.npmjs.org, read:~/.npmrc, write:<skill>/node_modules/.bin/mcp-server-memory, write:<skill>/node_modules/.bin/node-which · install scripts: exit 127; 36 tool calls
mcp:time-travel ok · 15.4s

no new behavior · install scripts: exit 127; 36 tool calls
mcp:ci-github ok · 9.2s

no new behavior · install scripts: exit 127; 36 tool calls
mcp-agent:agent ok · 19.1s

no new behavior · install scripts: exit 127

$ server_memory__create_entities({"entities": [{"name": "Ada Lovelace", "entityType": "person", "observations": ["Mathematician and early computing pione) $ server_memory__read_graph({}) $ server_memory__create_relations({"relations": [{"from": "Ada Lovelace", "to": "Analytical Engine", "relationType": "wrote notes about"}]}) $ server_memory__add_observations({"observations": [{"entityName": "Ada Lovelace", "contents": ["Often credited with writing the first algorithm intended ) $ server_memory__search_nodes({"query": "algorithm"}) $ server_memory__open_nodes({"names": ["Analytical Engine"]}) $ server_memory__delete_observations({"deletions": [{"entityName": "Ada Lovelace", "observations": ["Daughter of the poet Lord Byron"]}]}) $ server_memory__delete_relations({"relations": [{"from": "Ada Lovelace", "to": "Analytical Engine", "relationType": "wrote notes about"}]}) $ server_memory__delete_entities({"entityNames": ["Analytical Engine"]}) $ server_memory__read_graph({}) model said: I exercised all 8 tools on the `server_memory` MCP server. Here's what each returned: | Tool | Sample input | Result | |---|---|---| | `create_entities` | Two entities: "Ada Lovelace" (person) and "Analytical Engine" (machine), 2 observations each | Returned both entities as created, echoing the full objects. No `skipped` field, so nothing was rejected. | | `read_graph` | — | Returned `{entities:

mcp: coverage plateau (2 runs with no new behavior); agent: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.