npm · mcp0.20.5

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler in admin.js calls the REST API to restore user access without checking whether the caller has admin or ownership scope. Add a scope validation check before the API call by calling `requireAdminScope(callerContext)` that verifies the caller's JWT or session token contains 'admin' or 'owner' scope; if not, throw an AuthorizationError. This ensures only authorized users can restore access. Verify the fix by running the CLI with a non-admin user token and confirming the command returns a 403 Forbidden error.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler in admin.js calls the REST API to restore user access without checking whether the caller has admin or ownership scope. Add a scope validation check before the API call by calling `requireAdminScope(callerContext)` that verifies the caller's JWT or session token contains 'admin' or 'owner' scope; if not, throw an AuthorizationError. This ensures only authorized users can restore access. Verify the fix by running the CLI with a non-admin user token and confirming the command returns a 403 Forbidden error.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler in admin.js calls the REST API to restore user access without checking whether the caller has admin or ownership scope. Add a scope validation check before the API call by calling `requireAdminScope(callerContext)` that verifies the caller's JWT or session token contains 'admin' or 'owner' scope; if not, throw an AuthorizationError. This ensures only authorized users can restore access. Verify the fix by running the CLI with a non-admin user token and confirming the command returns a 403 Forbidden error.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler in admin.js calls the REST API to restore user access without checking whether the caller has admin or ownership scope. Add a scope validation check before the API call by calling `requireAdminScope(callerContext)` that verifies the caller's JWT or session token contains 'admin' or 'owner' scope; if not, throw an AuthorizationError. This ensures only authorized users can restore access. Verify the fix by running the CLI with a non-admin user token and confirming the command returns a 403 Forbidden error.

Evidence

/**

 * admin — CLI admin subcommands for gramatr user/org/team management.

 *

 * Calls the server REST API admin endpoints with local auth credentials.

RemediationAI

The problem is that the 'restore-access' handler in admin.js calls the REST API to restore user access without checking whether the caller has admin or ownership scope. Add a scope validation check before the API call by calling `requireAdminScope(callerContext)` that verifies the caller's JWT or session token contains 'admin' or 'owner' scope; if not, throw an AuthorizationError. This ensures only authorized users can restore access. Verify the fix by running the CLI with a non-admin user token and confirming the command returns a 403 Forbidden error.

Evidence

// gramatr-allow: c1

const API_KEY_LEGACY = process.env['GMTR_API_KEY'] || '';

const API_KEY = API_KEY_PRIMARY || API_KEY_LEGACY;

const cliEnv = { home: HOME_DIR, serverUrl: SERVER_URL, apiKey: API_KEY };

// ---- Config helpers --------------------------------------------------------

function getServerBase() {

    return cliEnv.serverUrl.replace(/\/mcp\/?$/, '');

RemediationAI

The problem is that adminFetch() uses a static module-level API_KEY credential loaded at import time, which means all requests are authenticated as a single privileged identity regardless of who invoked the CLI command. Replace the static API_KEY with a per-request credential by modifying adminFetch() to accept a callerCredential parameter and pass it in the Authorization header instead of using the module-level API_KEY constant. This ensures each request is authenticated as the actual caller, not a shared service account. Verify the fix by logging the Authorization header value in adminFetch() and confirming it reflects the current user's token, not a static key.

Evidence

export async function readInteractive() {

    log('');

    log('Paste your gramatr API key below.');

    log('(keys usually start with sk_)');

    log('');

    process.stdout.write('  Key: ');

    const rl = createInterface({ input: process.stdin, output: process.stdout });

RemediationAI

The problem is that validateAgainstServer() accepts a user-supplied API key and validates it against the server without verifying that the caller is authorized to use that key (e.g., the key belongs to the caller's account). Add a caller identity check by requiring the caller to provide their own credentials (JWT or session token) and verify that the supplied API key is registered to that caller's account before validation. This prevents users from validating or using API keys that belong to other users. Verify the fix by attempting to validate an API key belonging to a different user account and confirming the function returns an authorization error.

Evidence

#!/usr/bin/env node

import { existsSync, unlinkSync } from 'fs';

import { join } from 'path';

import { getGramatrDirFromEnv, getHomeDir } from '../config-runtime.js';

RemediationAI

The problem is that clearAll() in clear-creds.js deletes sensitive files (~/.gramatr.json and settings.json) but the function signature and documentation do not disclose these filesystem side effects. Add JSDoc documentation to the clearAll() function with an @sideEffect tag listing the files deleted, and rename the function to clearAllCredentialsAndSettings() to make the destructive intent explicit in the name. This makes the side effects visible to callers and reviewers. Verify the fix by checking that the JSDoc appears in IDE tooltips and that the function name clearly indicates file deletion.

Evidence

#!/usr/bin/env node

import { chmodSync, existsSync, readFileSync, writeFileSync } from 'fs';

import { join } from 'path';

import { createInterface } from 'readline';

RemediationAI

The problem is that writeKey() in add-api-key.js writes sensitive credentials to ~/.gramatr.json but the function signature and documentation do not disclose this filesystem side effect. Add JSDoc documentation to writeKey() with an @sideEffect tag explicitly stating that it writes the API key to ~/.gramatr.json with restricted file permissions, and update the function name to writeApiKeyToFile() to make the intent explicit. This makes the side effect visible to callers and reviewers. Verify the fix by checking that the JSDoc appears in IDE tooltips and that the function name clearly indicates file writing.

Evidence

#!/usr/bin/env node

import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

import { execFileSync } from 'node:child_process';

import { dirname, join, resolve } from 'node:path';

RemediationAI

The problem is that buildMcpb() in build-mcpb.js performs multiple filesystem side effects (ensureDir, writeManifest, copyRuntimeFiles, buildArchive) but the function documentation does not disclose them. Add comprehensive JSDoc documentation to buildMcpb() with @sideEffect tags listing all filesystem operations (directory creation, file writes, file copies, archive creation), and document the output directory and artifact locations. This makes the side effects visible to callers and reviewers. Verify the fix by checking that the JSDoc appears in IDE tooltips and lists all filesystem operations performed.

Evidence

/**

 * brain — CLI subcommand for bulk file upload to the grāmatr brain.

 *

 * Reads local files (txt, md, csv, pdf, docx) and uploads them to the server

RemediationAI

The problem is that the brain upload functionality performs network side effects (callTool invokes bulk_upload MCP tool) and filesystem side effects (writeManifestAtomic writes manifest files) but the tool description does not fully disclose these. Add comprehensive documentation to the brain command and its internal functions with @sideEffect tags listing network calls to the bulk_upload MCP tool and filesystem writes to manifest files, including the manifest file paths. This makes the side effects visible to callers and reviewers. Verify the fix by checking that the command help text and function JSDoc list all network and filesystem operations.

Evidence

#!/usr/bin/env node

import { chmodSync, existsSync, readFileSync, writeFileSync } from 'fs';

import { join } from 'path';

import { createInterface } from 'readline';

RemediationAI

The problem is that writeKey() in add-api-key.js writes sensitive credentials to ~/.gramatr.json but the function signature and documentation do not disclose this filesystem side effect. Add JSDoc documentation to writeKey() with an @sideEffect tag explicitly stating that it writes the API key to ~/.gramatr.json with restricted file permissions, and update the function name to writeApiKeyToFile() to make the intent explicit. This makes the side effect visible to callers and reviewers. Verify the fix by checking that the JSDoc appears in IDE tooltips and that the function name clearly indicates file writing.

Evidence

/**

 * brain — CLI subcommand for bulk file upload to the grāmatr brain.

 *

 * Reads local files (txt, md, csv, pdf, docx) and uploads them to the server

 * via the `bulk_upload` MCP tool. The server is the single source of truth

 * for validation, idempotency (sha256-based dedup), virus scanning (ClamAV),

 * and entity/observation creation. The CLI is a thin wrapper.

 *

 * Migrated in epic #1904 PR 3 from the legacy `create_entity` + `add_observation`

 * chain. The orphan-fix that PR 1 added to

RemediationAI

The problem is that brain.js reads untrusted file content from the local filesystem and uploads raw bytes to the server without visible provenance delimiters, making it difficult to distinguish uploaded content from server responses or validation results. Wrap all uploaded file content with explicit provenance markers (e.g., '--- BEGIN UPLOADED FILE: <filename> ---' and '--- END UPLOADED FILE: <filename> ---') before sending to the bulk_upload MCP tool, and ensure these markers appear in all server responses and logs. This provides clear visual separation between user-supplied content and system output. Verify the fix by uploading a test file and confirming the provenance markers appear in the tool output and server response.

Evidence

"vitest": "^4.0.18"

  },

  "scripts": {

    "postinstall": "node scripts/postinstall.mjs",

    "build": "tsc --build && node ./scripts/build-marketplace.mjs",

    "build:binary": "node ./scripts/build-binary.mjs",

    "build:marketplace": "node ./scripts/build-marketplace.mjs",

RemediationAI

The problem is that package.json declares a postinstall hook (node scripts/postinstall.mjs) which executes arbitrary code whenever anyone installs this package, creating a supply-chain attack surface. Review the contents of scripts/postinstall.mjs to confirm it only performs necessary setup (e.g., optional native module compilation); if it performs network calls, downloads, or other risky operations, move that logic to a separate optional setup script and remove the postinstall hook. Update package.json to remove the postinstall entry and document any manual setup steps in the README. Verify the fix by running npm install in a clean environment and confirming no unexpected network calls or file modifications occur.

Evidence

# @gramatr/mcp

Intelligence middleware for AI agents by [gramatr](https://gramatr.com).

Pre-classifies every request, injects relevant memory and behavioral context,

enforces data quality, and maintains session continuity across Claude, ChatGPT,

Codex, Cursor, Gemini, and any MCP-compatible client.

## Quick Install (Claude Code)

```bash

npx @gramatr/mcp install

```

Idempotent. Safe to re-run for upgrades. Configures everything in one shot:

1. **Auth check** — runs device-flow login if `~/.

RemediationAI

The problem is that the MCP manifest does not declare an authentication mechanism, making it unclear how the server validates caller identity and authorization. Add an explicit 'auth' or 'authorization' field to the manifest (in README.md or the MCP config file) documenting the authentication method used (e.g., 'bearer: JWT token in Authorization header', 'apiKey: GMTR_API_KEY environment variable', 'mtls: mutual TLS certificate validation'). This allows reviewers to audit the authentication implementation. Verify the fix by checking that the manifest clearly states the authentication mechanism and that the implementation matches the declared method.

Evidence

stdio: "inherit",

      timeout: 300000, // 5 min — enough for OAuth browser flow

    });

  } catch {

  }

}

main().catch(() => process.exit(0));

RemediationAI

The problem is that the catch block in scripts/postinstall.mjs silently swallows exceptions with no logging, making it impossible to debug failures or detect real errors during installation. Replace the empty catch block with a logging statement: `catch (err) { console.error('postinstall warning:', err.message); }` to ensure errors are visible to users and developers. This enables incident response and helps identify real failures. Verify the fix by intentionally causing an error in the postinstall script and confirming the error message appears in the npm install output.