roadmap

SUSPICIOUS: the core behavior fits an internal roadmap viewer, and data flows remain local/internal, but the fallback hardcodes database credentials and grants direct DB access that is broader than necessary. This looks more like over-privileged internal tooling than malware; the main risk is credential exposure and unnecessary bypass of the preferred MCP interface.