{"id":"70ade50dca29","status":"done","kind":"auto","source":"npm","target":"npm:@modelcontextprotocol/server-memory","name":"@modelcontextprotocol/server-memory","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":2,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-25T09:52:14.495153Z","finished_at":"2026-10-25T09:53:26.539469Z","report_url":"https://detonationlabs.com/r/70ade50dca29","progress":[{"phase":"mcp","label":"baseline","status":"ok","duration":9.7,"new":["dns:registry.npmjs.org","read:~/.npmrc","write:<skill>/node_modules/.bin/mcp-server-memory","write:<skill>/node_modules/.bin/node-which","write:<skill>/node_modules/@modelcontextprotocol/server-memory/dist/memory.jsonl"],"findings":[],"note":"install scripts: exit 127; 36 tool calls"},{"phase":"mcp","label":"time-travel","status":"ok","duration":15.4,"new":[],"findings":[],"note":"install scripts: exit 127; 36 tool calls"},{"phase":"mcp","label":"ci-github","status":"ok","duration":9.2,"new":[],"findings":[],"note":"install scripts: exit 127; 36 tool calls"},{"phase":"mcp-agent","label":"agent","status":"ok","duration":19.1,"new":[],"findings":[],"note":"install scripts: exit 127"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-25T09:53:26Z","target":{"name":"@modelcontextprotocol/server-memory","sha256":"8a97161b66a3a442355ff0d654be04db12e74066cca8704f7d7dab06a323f1fb","files":0,"scripts":[],"declared":{},"trigger_hints":[],"source":"npm:@modelcontextprotocol/server-memory@1.0.0","command":"node skill/node_modules/@modelcontextprotocol/server-memory/dist/index.js","kind":"mcp","version":"1.0.0"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":["registry.npmjs.org"],"files_written":["<skill>/node_modules/.bin/mcp-server-memory","<skill>/node_modules/.bin/node-which","<skill>/node_modules/@modelcontextprotocol/server-memory/dist/memory.jsonl","<skill>/node_modules/@modelcontextprotocol/server-memory/dist/memory.jsonl.*.tmp","<skill>/node_modules/@modelcontextprotocol/server-memory/dist/memory.jsonl.lock","~/.npm/_logs/*-debug-0.log","~/.npm/_update-notifier-last-checked"],"secrets_read":["~/.npmrc"],"commands":[],"exfiltration":[]},"findings":[{"rule":"network-egress","severity":"low","title":"Network destinations contacted","evidence":["registry.npmjs.org"],"run_label":"mcp:baseline"},{"rule":"secret-read-by-owner","severity":"low","title":"A tool read its own credentials (e.g. gh, aws, ssh)","evidence":["~/.npmrc (by npm)"],"run_label":"mcp:baseline"}],"exploration":{"runs":[{"phase":"mcp","target":"@modelcontextprotocol/server-memory","label":"baseline","status":"ok","duration":9.703,"new_signatures":["dns:registry.npmjs.org","read:~/.npmrc","write:<skill>/node_modules/.bin/mcp-server-memory","write:<skill>/node_modules/.bin/node-which","write:<skill>/node_modules/@modelcontextprotocol/server-memory/dist/memory.jsonl","write:<skill>/node_modules/@modelcontextprotocol/server-memory/dist/memory.jsonl.*.tmp","write:<skill>/node_modules/@modelcontextprotocol/server-memory/dist/memory.jsonl.lock","write:~/.npm/_logs/*-debug-0.log","write:~/.npm/_update-notifier-last-checked"],"findings":2,"note":"install scripts: exit 127; 36 tool calls","commands":[],"agent_reply":""},{"phase":"mcp","target":"@modelcontextprotocol/server-memory","label":"time-travel","status":"ok","duration":15.407,"new_signatures":[],"findings":0,"note":"install scripts: exit 127; 36 tool calls","commands":[],"agent_reply":""},{"phase":"mcp","target":"@modelcontextprotocol/server-memory","label":"ci-github","status":"ok","duration":9.213,"new_signatures":[],"findings":0,"note":"install scripts: exit 127; 36 tool calls","commands":[],"agent_reply":""},{"phase":"mcp-agent","target":"@modelcontextprotocol/server-memory","label":"agent","status":"ok","duration":19.121,"new_signatures":[],"findings":0,"note":"install scripts: exit 127","commands":["server_memory__create_entities({\"entities\": [{\"name\": \"Ada Lovelace\", \"entityType\": \"person\", \"observations\": [\"Mathematician and early computing pione)","server_memory__read_graph({})","server_memory__create_relations({\"relations\": [{\"from\": \"Ada Lovelace\", \"to\": \"Analytical Engine\", \"relationType\": \"wrote notes about\"}]})","server_memory__add_observations({\"observations\": [{\"entityName\": \"Ada Lovelace\", \"contents\": [\"Often credited with writing the first algorithm intended )","server_memory__search_nodes({\"query\": \"algorithm\"})","server_memory__open_nodes({\"names\": [\"Analytical Engine\"]})","server_memory__delete_observations({\"deletions\": [{\"entityName\": \"Ada Lovelace\", \"observations\": [\"Daughter of the poet Lord Byron\"]}]})","server_memory__delete_relations({\"relations\": [{\"from\": \"Ada Lovelace\", \"to\": \"Analytical Engine\", \"relationType\": \"wrote notes about\"}]})","server_memory__delete_entities({\"entityNames\": [\"Analytical Engine\"]})","server_memory__read_graph({})"],"agent_reply":"I exercised all 8 tools on the `server_memory` MCP server. Here's what each returned:\n\n| Tool | Sample input | Result |\n|---|---|---|\n| `create_entities` | Two entities: \"Ada Lovelace\" (person) and \"Analytical Engine\" (machine), 2 observations each | Returned both entities as created, echoing the full objects. No `skipped` field, so nothing was rejected. |\n| `read_graph` | — | Returned `{entities: [2], relations: []}` — the whole graph at that moment. |\n| `create_relations` | Ada Lovelace → Anal"}],"stopped":"mcp: coverage plateau (2 runs with no new behavior); agent: variants exhausted","model_usage":{"prompt_tokens":20541,"completion_tokens":1129,"llm_runs":1}},"note":"Observed behavior only. A clean result does not prove a package is safe."}}