npm · mcp0.20.5

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler restores user access without verifying caller permissions. Add `requireAdminScope(callerIdentity, targetEmail)` before the restore operation to validate admin authorization. This prevents unauthorized access restoration. Verify by attempting restore-access as a non-admin user and confirming the request is denied.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler restores user access without verifying caller permissions. Add `requireAdminScope(callerIdentity, targetEmail)` before the restore operation to validate admin authorization. This prevents unauthorized access restoration. Verify by attempting restore-access as a non-admin user and confirming the request is denied.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler restores user access without verifying caller permissions. Add `requireAdminScope(callerIdentity, targetEmail)` before the restore operation to validate admin authorization. This prevents unauthorized access restoration. Verify by attempting restore-access as a non-admin user and confirming the request is denied.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler restores user access without verifying caller permissions. Add `requireAdminScope(callerIdentity, targetEmail)` before the restore operation to validate admin authorization. This prevents unauthorized access restoration. Verify by attempting restore-access as a non-admin user and confirming the request is denied.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler restores user access without verifying caller permissions. Add `requireAdminScope(callerIdentity, targetEmail)` before the restore operation to validate admin authorization. This prevents unauthorized access restoration. Verify by attempting restore-access as a non-admin user and confirming the request is denied.

Evidence

// gramatr-allow: c1

const API_KEY_LEGACY = process.env['GMTR_API_KEY'] || '';

const API_KEY = API_KEY_PRIMARY || API_KEY_LEGACY;

const cliEnv = { home: HOME_DIR, serverUrl: SERVER_URL, apiKey: API_KEY };

// ---- Config helpers --------------------------------------------------------

function getServerBase() {

    return cliEnv.serverUrl.replace(/\/mcp\/?$/, '');

RemediationAI

The problem is that adminFetch() uses a static module-level API_KEY from process.env, ignoring the actual caller's identity and permissions. Replace the hardcoded credential approach with a function `adminFetch(callerToken, endpoint, options)` that accepts the caller's token and validates it against the endpoint's required scopes before making the request. This ensures each API call is authenticated to the actual caller, not a shared service account. Verify by logging the caller identity in adminFetch and confirming it matches the user making the CLI command.

Evidence

export async function readInteractive() {

    log('');

    log('Paste your gramatr API key below.');

    log('(keys usually start with sk_)');

    log('');

    process.stdout.write('  Key: ');

    const rl = createInterface({ input: process.stdin, output: process.stdout });

RemediationAI

The problem is that validateAgainstServer() accepts a user-supplied API key and validates it without confirming the caller is authorized to use that key. Modify the function signature to `validateAgainstServer(callerIdentity, userSuppliedKey)` and add a check that the caller owns or has permission to use the supplied key before calling the server endpoint. This prevents users from validating or activating API keys belonging to other users. Test by attempting to validate another user's API key and confirm it is rejected.

Evidence

#!/usr/bin/env node

import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

import { execFileSync } from 'node:child_process';

import { dirname, join, resolve } from 'node:path';

RemediationAI

The problem is that buildMcpb() performs filesystem operations (mkdirSync, writeFileSync, copyFileSync, rmSync) without documenting these side effects. Update the JSDoc comment to include `@side-effect Filesystem: creates directories, writes/copies/removes files in build output directory` and add a parameter `{ dryRun?: boolean }` to allow callers to preview changes. This makes side effects explicit and testable. Verify by running buildMcpb with dryRun=true and confirming no files are modified.

Evidence

/**

 * brain — CLI subcommand for bulk file upload to the grāmatr brain.

 *

 * Reads local files (txt, md, csv, pdf, docx) and uploads them to the server

RemediationAI

The problem is that the brain upload function performs network calls (callTool to server) and filesystem writes (writeManifestAtomic) without fully disclosing these side effects in the documentation. Expand the JSDoc to include `@side-effect Network: uploads files via bulk_upload MCP tool; Filesystem: writes manifest to ~/.gramatr/brain-manifest.json` and add error handling that rolls back manifest writes on network failure. This makes side effects transparent and recoverable. Test by simulating a network failure mid-upload and confirming the manifest is not partially written.

Evidence

#!/usr/bin/env node

import { existsSync, unlinkSync } from 'fs';

import { join } from 'path';

import { getGramatrDirFromEnv, getHomeDir } from '../config-runtime.js';

RemediationAI

The problem is that clearAll() deletes credential files via unlinkSync without documenting this destructive side effect. Add a JSDoc comment `@side-effect Filesystem: permanently deletes credential files from ~/.gramatr/` and add a confirmation prompt `await confirmUserAction('This will permanently delete all stored credentials. Continue?')` before executing unlinkSync. This prevents accidental credential loss. Verify by running clearAll() and confirming it prompts for confirmation before deletion.

Evidence

#!/usr/bin/env node

import { chmodSync, existsSync, readFileSync, writeFileSync } from 'fs';

import { join } from 'path';

import { createInterface } from 'readline';

RemediationAI

The problem is that main() performs network validation and filesystem credential storage without fully disclosing these side effects in the help text. Update the help/description text to include 'This command will: (1) validate your API key with the server, (2) store the key in ~/.gramatr.json' and add a dry-run flag `--dry-run` that performs validation without writing credentials. This ensures users understand the side effects before running. Verify by running with --dry-run and confirming no credentials are written.

Evidence

#!/usr/bin/env node

import { chmodSync, existsSync, readFileSync, writeFileSync } from 'fs';

import { join } from 'path';

import { createInterface } from 'readline';

RemediationAI

The problem is that main() performs network validation and filesystem credential storage without fully disclosing these side effects in the help text. Update the help/description text to include 'This command will: (1) validate your API key with the server, (2) store the key in ~/.gramatr.json' and add a dry-run flag `--dry-run` that performs validation without writing credentials. This ensures users understand the side effects before running. Verify by running with --dry-run and confirming no credentials are written.

Evidence

/**

 * brain — CLI subcommand for bulk file upload to the grāmatr brain.

 *

 * Reads local files (txt, md, csv, pdf, docx) and uploads them to the server

 * via the `bulk_upload` MCP tool. The server is the single source of truth

 * for validation, idempotency (sha256-based dedup), virus scanning (ClamAV),

 * and entity/observation creation. The CLI is a thin wrapper.

 *

 * Migrated in epic #1904 PR 3 from the legacy `create_entity` + `add_observation`

 * chain. The orphan-fix that PR 1 added to

RemediationAI

The problem is that brain upload reads untrusted local files and sends raw bytes to the server without marking uploaded content boundaries, making it difficult to distinguish attacker-controlled content from server responses. Wrap each uploaded file with explicit delimiters in the request: `{ file_name, file_hash, content_start_marker: '<<<FILE_START>>>', content: rawBytes, content_end_marker: '<<<FILE_END>>>' }` and require the server to echo these markers in responses. This provides provenance and prevents content injection attacks. Test by uploading a file containing server response patterns and confirming the markers prevent confusion.

Evidence

"vitest": "^4.0.18"

  },

  "scripts": {

    "postinstall": "node scripts/postinstall.mjs",

    "build": "tsc --build && node ./scripts/build-marketplace.mjs",

    "build:binary": "node ./scripts/build-binary.mjs",

    "build:marketplace": "node ./scripts/build-marketplace.mjs",

RemediationAI

The problem is that package.json declares a postinstall hook that runs arbitrary code during npm install, creating a supply-chain attack surface. Remove the `"postinstall": "node scripts/postinstall.mjs"` line from scripts and move any necessary setup into a separate setup script or documentation step that users run explicitly. If the hook is truly necessary, add a comment explaining why and audit scripts/postinstall.mjs for security issues. Verify by running npm install in a clean environment and confirming postinstall.mjs does not execute.

Evidence

# @gramatr/mcp

Intelligence middleware for AI agents by [gramatr](https://gramatr.com).

Pre-classifies every request, injects relevant memory and behavioral context,

enforces data quality, and maintains session continuity across Claude, ChatGPT,

Codex, Cursor, Gemini, and any MCP-compatible client.

## Quick Install (Claude Code)

```bash

npx @gramatr/mcp install

```

Idempotent. Safe to re-run for upgrades. Configures everything in one shot:

1. **Auth check** — runs device-flow login if `~/.

RemediationAI

The problem is that the MCP manifest does not declare an authentication mechanism, making it unclear how the server validates caller identity. Add an explicit `"authentication": { "type": "bearer", "description": "Caller must provide valid API key via Authorization: Bearer header or GMTR_API_KEY env var" }` field to the manifest or README. This clarifies the security model for auditors. Verify by reviewing the manifest and confirming the auth field matches the actual implementation in admin.js and add-api-key.js.

Evidence

stdio: "inherit",

      timeout: 300000, // 5 min — enough for OAuth browser flow

    });

  } catch {

  }

}

main().catch(() => process.exit(0));

RemediationAI

The problem is that the catch block in postinstall.mjs silently swallows exceptions with no logging, hiding real failures during installation. Replace `catch { }` with `catch (err) { console.error('postinstall failed:', err.message); process.exit(1); }` to log the error and exit with a non-zero code. This ensures installation failures are visible and incident response is possible. Verify by intentionally breaking the postinstall script and confirming the error message is logged and npm install fails.