agentic-mcp

SUSPICIOUS: The stated purpose matches a local MCP management skill, and the main CLI distribution appears consistent with the publisher. The main risk is transitive trust: the skill is designed to spawn arbitrary MCP servers from user config, including unpinned npm packages via npx -y, so its security posture depends heavily on downstream servers rather than the skill text itself.

This code manages local daemon sockets and metadata files, but does not validate session values before using them in paths. A caller able to control the session, including via MCP_DAEMON_SESSION, may cause writes or deletions outside the temporary directory through path traversal; severity is moderate and depends on that control. No external domains, URLs, or IP addresses are contacted, and no clear malware behavior is present.