nsm-session-pivot

Mostly coherent, narrowly scoped forensic guidance, but it depends on an unverified external MCP server that performs the real work. With no proven public provenance/install trail for nsm-mcp, the main issue is supply-chain trust rather than confirmed malicious behavior.