software_project · DiggingBeagle record
common-context-mcp
Npm MCP memory package with cross-agent postinstall configuration changes.
- Entity kind
- software_project
Record description
common-context-mcp is an npm-distributed MCP memory integration which LPM says registers itself in multiple user-level coding-agent configurations during installation, including shared context loading across sessions. The relevant security change is persistent local tool and instruction availability rather than documented network data theft.
The published package analysis identifies a postinstall entrypoint, scripts/postinstall.js, that writes persistent agent-MCP registrations. That is a durable configuration mutation, not by itself a verified network exfiltration event; later process execution and uninstall behavior require a separate trace.