common-context-mcp automatically registered persistent shared memory across coding agents

The common-context-mcp package is reported to modify user-level configuration in Claude-related and other coding-agent environments when installed. Those entries make a shared-context MCP server and persistent memory instructions available to later sessions, potentially outside the particular project in which the package was first installed. This is an operational change even when no network destination is involved.

The trust boundary is between an npm dependency lifecycle hook and the persistent, cross-project authority of agent configuration. LPM flagged the behavior but did not show malicious commands, confirmed extraction of private content or a real abuse campaign. A separate package, agent-nervous-system-mcp, was mentioned in the same Radar occurrence but requires its own source verification and is not silently merged into this case. Source report.

The package installer runs scripts/postinstall.js and writes MCP server registration into agent configuration files outside its package directory. Because those files are read in later sessions, installing one npm dependency can change which tools and durable memory sources several coding agents discover. That mechanism is distinct from a subsequent prompt injection, where untrusted content attempts to redirect an already running model, and from the toga-ai case, where the primary observed change is content telemetry configuration. LPM classifies the automatic registration as control-surface risk, but this record does not assert that the shared-context file was sent over a network. Verification would compare pre-install and post-install configuration, then check whether uninstallation or package removal reverses each registration.