Independent AI systems researchOperated by NeuralArc
AccessAllGPTRESEARCH
Menu
Evidence index

Inspect the source before the verdict.

This index exposes the material behind every decision guide: what we reviewed, when we retrieved it, the claim it supports and where the evidence stops.

181decision guides
790source records
782scoped claim notes
How to read this index

A citation is not a transferable result.

Reviewed identifies the part of the source used. Supports states the bounded proposition we draw from it. Retrieved records when time-sensitive material was checked.

Vendor documentation establishes vendor claims and product behavior as documented, not independent performance. Papers establish results only for their stated methods and tested scope. AccessAllGPT recommendations remain labeled analysis.

Read the full methodology →
Source ledger

Evidence by decision guide

Ordered by the latest publication or material update date. Follow a source to inspect the original material.

Agents

A Lost MCP SSE Response Can Hold an AI Agent Until Its Timeout

AccessAllGPT reviewed the MCP 2025-11-25 Streamable HTTP specification, @modelcontextprotocol/sdk 1.30.0 release and registry records, the pinned transport implementation, public issue 2739 and a separate contributor’s Node 22 reproduction. I wrote and ran scripts/audit-mcp-sse-response-lifecycle.mjs on Node v24.10.0 and Darwin arm64. A clean temporary sandbox installed SDK 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled. A synthetic fetch fixture completed protocol initialization, then answered ping in five controlled modes: errored POST SSE at 300 ms and 900 ms deadlines, clean-EOF POST SSE at both deadlines, and application/json at 900 ms. Forty-two assertions bound settlement timing, error routing, cancellation messages, response mode, package version and distributed source. The transport file was bound to SHA-256 a181da6a31e8a34acd3e011ce5e574e8f1381b17f4541f64afcfb6b7209bafa3. No model, production agent, remote server, credential, network target, external action or user data was used.

6 sources · 6 retrieval dates · 6 scoped claim notes

  1. Transports (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Streamable HTTP architecture, POST request rules, JSON and SSE response modes, listening streams, disconnection and session management

    Supports: The specification permits a server to answer an MCP JSON-RPC request with either application/json or text/event-stream and requires an SSE response eventually to include the JSON-RPC response for that request.

  2. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, tag, publication date, v1.x branch and changed-package record

    Supports: The official release record binds the tested @modelcontextprotocol/sdk package to version 1.30.0, released July 27, 2026 on the v1.x line.

  3. StreamableHTTPClientTransport at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: SSE reader lifecycle, EOF and error branches, processStream invocation, POST send path, response media-type branch and JSON control path

    Supports: The pinned implementation starts its SSE reader without returning or awaiting the reader task; errors reach the transport onerror callback, while send returns after handing off an SSE body. The JSON branch awaits and parses its response directly.

  4. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, distribution integrity, publication metadata, repository and runtime requirements

    Supports: The npm registry identifies the installable official SDK 1.30.0 artifact used in the clean sandbox and binds it to distribution metadata.

  5. POST SSE responses remain pending after EOF or error (issue 2739)

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Original report, reproduction, expected behavior, implementation analysis, tested versions, related lifecycle issues and open state

    Supports: An independent contributor reported on August 30 that SDK 1.26.0 and 1.29.0 left request-scoped SSE responses pending until the protocol timeout after body EOF or error, and distinguished the case from explicit cancellation.

  6. Independent SDK 1.30.0 reproduction on issue 2739

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent environment, SDK versions, 300 millisecond measurements, SSE error path, clean EOF path, JSON control and linked reproduction

    Supports: A second contributor independently reported the same timeout-bound settlement on Node 22.18.0 with SDK 1.29.0 and 1.30.0, while an application/json control resolved promptly.

Agents

An Optional MCP Task Schema Can Strand an Agent’s Completed Result

AccessAllGPT reviewed the current MCP Tasks extension overview, the @modelcontextprotocol/sdk 1.30.0 release and registry records, the pinned experimental task wrapper, protocol request path and Zod compatibility implementation, plus public issue 2742 and its independent follow-up reproduction. I wrote and ran scripts/audit-mcp-task-result-schema.mjs on Node v24.10.0 and Darwin arm64. A clean temporary sandbox installed SDK 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, connected official Client and Server instances through linked in-memory transports, created one inert synthetic tool task, stored one text result, and compared getTaskResult with its schema omitted against the same call with CallToolResultSchema supplied. Fifteen assertions passed. The distributed experimental task client was bound to SHA-256 bfa97c01d4394fc53f9c659c7e156f96b1727b6d0052b0db52969251b9afe2cd. No model, production agent, remote server, credential, network target, external action or user data was used.

6 sources · 6 retrieval dates · 6 scoped claim notes

  1. Tasks: asynchronous task execution for long-running MCP operations

    Model Context Protocol · Retrieved

    Reviewed: Task purpose, non-blocking rationale, crash resilience, lifecycle, polling, result retrieval, client guidance and extension status

    Supports: The current Tasks extension describes a task ID as a durable handle and result retrieval as the step that returns a completed long-running operation after polling or reconnecting.

  2. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, tag, publication date, v1.x branch and changed-package record

    Supports: The official release record binds the tested @modelcontextprotocol/sdk package to version 1.30.0, released July 27, 2026 on the v1.x line.

  3. Experimental task client at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: ExperimentalClientTasks.getTaskResult signature, optional resultSchema parameter, cast and delegation to the underlying Protocol method

    Supports: The pinned public wrapper types resultSchema as optional and forwards its runtime value, including undefined, to the underlying getTaskResult method.

  4. Task-result request and Zod compatibility paths at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Protocol.getTaskResult required schema parameter, request dispatch, response safeParse path, zod-compat isZ4Schema and safeParse implementation

    Supports: The pinned protocol method requires a result schema and passes it into response parsing; zod-compat checks schema._zod before falling back to a Zod 3 safeParse call, so an undefined schema cannot be parsed.

  5. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, distribution integrity, publication metadata, repository and runtime requirements

    Supports: The npm registry identifies the installable official SDK 1.30.0 artifact used in the clean sandbox and binds it to distribution metadata.

  6. getTaskResult throws when the optional result schema is omitted (issue 2742)

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent report, reproduction, expected and actual behavior, stack, workaround, environment and independent branch-level follow-up reproduction

    Supports: An independent contributor reported the optional-schema TypeError on August 31, 2026; a second contributor reported reproducing it on the current v1.x branch. These reports prompted but did not validate the AccessAllGPT run.

Agents

MCP v2 Can Return a Partial Tool List as Complete

AccessAllGPT reviewed the MCP 2026-07-28 pagination and tools specifications, the npm package record and pinned distributed implementation for @modelcontextprotocol/client 2.0.0, Anthropic’s original MCP announcement and public issue 2735. I wrote and ran scripts/audit-mcp-v2-repeated-cursor.mjs on Node v24.10.0 and Darwin arm64. The clean temporary sandbox installed the exact client package with lifecycle scripts disabled, then connected it to a synthetic in-process transport. Fifteen assertions compared a three-page repeated empty-string cursor sequence with a unique-cursor control and a distinct nonconverging sequence capped at three pages. The client bundle was bound to SHA-256 af3ec9fcf3a70fb4681e9b3c11aa18a7ce9aca36fed9f138a6e704043695d414. No model, production client, remote server, credential, network target, user data or real tool was used.

6 sources · 6 retrieval dates · 6 scoped claim notes

  1. Pagination (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Cursor model, request and response formats, opaque-value rule, supported list operations, implementation guidance and error handling

    Supports: The current protocol makes cursors opaque, says clients must not determine anything from a cursor value beyond whether a non-null value exists, treats an empty string as valid and defines absence of nextCursor as completion.

  2. Tools (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Tool discovery, list request and result shapes, pagination link, tool definition and security considerations

    Supports: The current tools contract makes tools/list a paginated discovery operation through which an AI client learns the callable tool inventory exposed by a server.

  3. @modelcontextprotocol/client 2.0.0 distributed implementation

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Client.listTools, _listAllPages, repeated-cursor seen set, listMaxPages branch, aggregate finalization and response-cache write

    Supports: The pinned v2 client auto-aggregates a cursorless listTools call, stops its loop when a cursor has been seen, deletes nextCursor and returns or caches the resulting aggregate; the separate page cap throws when reached.

  4. @modelcontextprotocol/client 2.0.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, publication artifact, repository, runtime requirement, integrity and distribution metadata

    Supports: The official npm registry record binds the tested split client package to version 2.0.0 on the TypeScript SDK repository and identifies the installable artifact plus its integrity metadata.

  5. Client.listTools() silently drops pages when a server repeats a cursor (issue 2735)

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent issue report, empty-string reproduction, actual and expected output, source analysis, proposed fix, comments and open status

    Supports: An independent contributor reported that client 2.0.0 stops automatic aggregation on a repeated cursor and removes the remaining-cursor signal; this prompted but did not independently validate the AccessAllGPT reproduction.

  6. Introducing the Model Context Protocol

    Anthropic · Retrieved

    Reviewed: November 25, 2024 announcement, protocol purpose, architecture, SDKs and ecosystem description

    Supports: Anthropic introduced MCP as an open standard for connecting AI assistants to data sources and tools, establishing why tool discovery affects an agent host’s available action surface.

Agents

MCP Pagination Can Evict Earlier Tool Validators

AccessAllGPT reviewed the current MCP 2026-07-28 pagination and tools specifications, the release record and pinned client implementation for @modelcontextprotocol/sdk 1.30.0, Anthropic’s original MCP announcement, public TypeScript SDK issue 2735 and OWASP’s independent prompt-injection guidance. I wrote and ran scripts/audit-mcp-paginated-tool-cache.mjs on Node v24.10.0 and Darwin arm64 with the official SDK 1.30.0, Zod 3.25.76 and linked in-memory transports. A deliberately nonconforming low-level synthetic server returned two one-tool pages; both tools declared an integer output but returned {value:"not-an-integer"}. Twelve assertions traversed the cursor, inspected both cache states, and compared calls to page-one and page-two tools. The pinned client source was bound to SHA-256 db6cc643f5cc095b2fd0b70bf691d1775f07a317e97555e3928559e815f5e32a. No model, production client, remote server, credential, network target or user data was used.

7 sources · 7 retrieval dates · 7 scoped claim notes

  1. Pagination (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Pagination model, response and request formats, supported operations, implementation guidelines and error handling

    Supports: The current protocol uses opaque cursor pagination, lists tools/list as paginated, says clients should support paginated flows and defines a missing nextCursor as the end of results.

  2. Tools (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Listing tools, tool definition, output schema, structured content, calling tools and security considerations

    Supports: The current tools contract makes list results paginated and defines optional outputSchema as the contract that successful structuredContent must match.

  3. @modelcontextprotocol/sdk 1.30.0 client implementation

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Client.listTools, cacheToolMetadata, getToolOutputValidator and callTool output-validation implementation

    Supports: The pinned v1 client calls cacheToolMetadata with each page returned by listTools; that method clears existing output validators before compiling validators from that response page.

  4. TypeScript SDK release 1.30.0

    Model Context Protocol on GitHub · Retrieved

    Reviewed: Release identity, branch, publication date and package change record

    Supports: The official release record binds the tested package to SDK version 1.30.0, released July 27, 2026 on the v1.x line.

  5. Client.listTools() silently drops pages when a server repeats a cursor (issue 2735)

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Issue report, v2.0.0 reproduction, observed truncation, protocol interpretation and open status

    Supports: A separate public report documents a different pagination failure in the v2 client: repeated opaque cursors can make automatic aggregation stop early. It does not report or validate the v1 validator-cache replacement reproduced here.

  6. LLM Prompt Injection Prevention Cheat Sheet

    OWASP Cheat Sheet Series · Retrieved

    Reviewed: Agent-specific attacks, thought and observation injection, least privilege, tool validation and trust-boundary guidance

    Supports: Independent defensive guidance treats tool output as untrusted content and recommends tool validation plus permission and session-context checks; it does not test MCP pagination or this SDK.

  7. Introducing the Model Context Protocol

    Anthropic · Retrieved

    Reviewed: November 25, 2024 announcement, protocol purpose, architecture, SDKs and ecosystem description

    Supports: Anthropic introduced MCP as an open standard for connecting AI assistants to data sources and tools, establishing why a complete discovered inventory matters to agent clients.

Agents

MCP Output Validation Depends on Tool Discovery

AccessAllGPT reviewed the current MCP 2026-07-28 tools specification and CallToolResult schema, the release record and pinned client/server implementation for @modelcontextprotocol/sdk 1.30.0, Anthropic’s original MCP announcement and OWASP’s independent prompt-injection defensive guidance. I wrote and ran scripts/audit-mcp-output-schema-cache.mjs on Node v24.10.0 and Darwin arm64 with the official SDK 1.30.0, Zod 3.25.76 and linked in-memory transports. A deliberately nonconforming low-level synthetic server advertised an integer score from 0 to 100 but returned {score:"ninety-nine"}. Ten assertions compared a direct call before discovery with the same call after listTools. The pinned client source was bound to SHA-256 db6cc643f5cc095b2fd0b70bf691d1775f07a317e97555e3928559e815f5e32a. No model, production client, remote server, credential, network target or user data was used.

7 sources · 7 retrieval dates · 7 scoped claim notes

  1. Tools (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Tool definition, output schema, structured content, calling tools, error handling and security considerations

    Supports: The current protocol defines outputSchema as an optional contract for structuredContent and says a conforming structured result must match that schema; it also separates tool execution errors from protocol errors.

  2. Schema reference: CallToolResult (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: CallToolResult content, structuredContent, isError and result metadata fields

    Supports: The schema requires structuredContent to be a JSON object when present, but the tool-specific output contract comes from the separately discovered Tool.outputSchema.

  3. @modelcontextprotocol/sdk 1.30.0 client implementation

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Client.callTool, cacheToolMetadata, getToolOutputValidator and listTools implementation

    Supports: The pinned client validates a tool result only when a validator is present in its metadata cache; listTools clears and repopulates that cache from discovered output schemas.

  4. @modelcontextprotocol/sdk 1.30.0 server implementation

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: High-level McpServer tool registration, input validation, output validation and callback dispatch

    Supports: The high-level McpServer validates registered tool structuredContent against its configured output schema before returning a successful result; this differs from the deliberately nonconforming low-level fixture used in the client probe.

  5. TypeScript SDK release 1.30.0

    Model Context Protocol on GitHub · Retrieved

    Reviewed: Release identity, tag, publication date and package change record

    Supports: The official release record binds the tested package to SDK version 1.30.0, released July 27, 2026.

  6. LLM Prompt Injection Prevention Cheat Sheet

    OWASP Cheat Sheet Series · Retrieved

    Reviewed: Agent-specific attacks, thought and observation injection, least privilege, tool validation and trust-boundary guidance

    Supports: Independent defensive guidance treats tool output as untrusted content and recommends validating tool calls against user permissions and session context; it does not test this SDK cache behavior.

  7. Introducing the Model Context Protocol

    Anthropic · Retrieved

    Reviewed: November 25, 2024 announcement, architecture, SDKs and ecosystem purpose

    Supports: Anthropic introduced MCP as an open standard for connecting AI assistants to data sources and tools, establishing why discovered tool contracts enter an agent client’s trust boundary.

Agents

MCP’s readOnlyHint Is Not a Permission Boundary

AccessAllGPT reviewed the current MCP 2026-07-28 tools specification and ToolAnnotations schema, the generated types and release record for @modelcontextprotocol/sdk 1.30.0, Anthropic’s original MCP announcement and Invariant Labs’ independent tool-poisoning report. I wrote and ran scripts/audit-mcp-tool-annotations.mjs on Node v24.10.0 and Darwin arm64 using the official SDK 1.30.0, Zod 3.25.76 and its linked in-memory client/server transport. The synthetic tool declared readOnlyHint=true, destructiveHint=false, idempotentHint=true and openWorldHint=false, then wrote one temporary marker on each of two calls. Eleven assertions verified discovery metadata, pre-call state, both responses, both writes and call count. The SDK specification type source was bound to SHA-256 f612706dcbe34de49a77f2458ba4e0ef9e767efffc0f38024e3d84a8f1f66414. No model, production client, external tool, credential, network target or user data was used.

6 sources · 6 retrieval dates · 6 scoped claim notes

  1. Tools (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Tool definition, annotations, user interaction model, calling tools and security considerations

    Supports: The current specification defines annotations as optional descriptions of tool behavior and normatively requires clients to consider them untrusted unless they come from trusted servers.

  2. Schema reference: ToolAnnotations (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: ToolAnnotations fields, defaults and semantic qualifications for read-only, destructive, idempotent and open-world hints

    Supports: The schema defines readOnlyHint, destructiveHint, idempotentHint and openWorldHint as behavioral hints, including defaults and the conditions under which some fields are meaningful.

  3. @modelcontextprotocol/sdk 1.30.0 generated specification types

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: ToolAnnotations interface, field comments, trust warning and Tool definition

    Supports: The pinned SDK type declarations say every ToolAnnotations property is a hint, may not faithfully describe behavior, and must not drive tool-use decisions when received from an untrusted server.

  4. TypeScript SDK release 1.30.0

    Model Context Protocol on GitHub · Retrieved

    Reviewed: Release identity, tag, commit, publication date and changed-package record

    Supports: The official release page binds the tested SDK package to version 1.30.0 and tag commit 2d889f2, released July 27, 2026.

  5. MCP Security Notification: Tool Poisoning Attacks

    Invariant Labs · Retrieved

    Reviewed: Threat definition, malicious tool-description example, reported client experiments, limitations and proposed mitigations

    Supports: Independent security researchers reported that malicious instructions in MCP tool descriptions could steer tested agents toward unauthorized reads and actions; this is adjacent threat evidence, not validation of this annotation probe.

  6. Introducing the Model Context Protocol

    Anthropic · Retrieved

    Reviewed: November 25, 2024 announcement, protocol purpose, architecture, SDKs and early ecosystem description

    Supports: Anthropic introduced MCP on November 25, 2024 as an open standard connecting AI assistants to data sources and tools, establishing the chronology and intended AI integration boundary.

Agents

npm ci --ignore-scripts Still Installs Runnable Package Binaries

AccessAllGPT reviewed npm CLI v11 ci and package.json bin documentation, npm 11.6.0 ci source, bundled @npmcli/arborist 9.1.4 source and the independent OpenSSF Package Analysis design. I wrote and ran scripts/audit-npm-ci-ignore-scripts-bin-links.mjs on Node v24.10.0, npm 11.6.0 and Darwin arm64. The audit bound installed source to SHA-256 digests 76cacc0ed9bbee8a7c1e5d5656201403a4dd688d31ee141b531c9e85a7e75e9e and 0915a24508d04986869407f80ef6f793a85abd1a4785e27b4029efcb7f4921dd, packed one synthetic local dependency, created a frozen lockfile, compared three fresh npm ci flows, explicitly invoked only the synthetic binary, and passed 20 assertions over hook markers, package files, symlink targets and invocation output. No registry package executable, external service, exploit, network access or publication was used.

5 sources · 5 retrieval dates · 5 scoped claim notes

  1. npm ci documentation, CLI v11

    npm Docs · Retrieved

    Reviewed: Description, clean-install guarantees, lockfile requirements, ignore-scripts and bin-links configuration

    Supports: npm documents ci as a lockfile-frozen clean install and lists ignore-scripts and bin-links as separate configuration controls; ignore-scripts suppresses package.json scripts while bin-links governs executable links.

  2. package.json bin field documentation, CLI v11

    npm Docs · Retrieved

    Reviewed: bin field mapping, executable files, local installation links and shebang requirement

    Supports: npm documents that local installs create links in node_modules/.bin for package bin entries so commands can be run by npm scripts and other callers.

  3. npm 11.6.0 ci command implementation

    npm CLI source · Retrieved

    Reviewed: Accepted configuration, lockfile validation, node_modules removal, Arborist reify dispatch and root lifecycle guard

    Supports: The pinned command accepts ignore-scripts and bin-links independently, passes flat options to Arborist reify, and uses ignore-scripts to guard root lifecycle events after dependency reification.

  4. Arborist 9.1.4 rebuild implementation bundled with npm 11.6.0

    npm CLI source via unpkg · Retrieved

    Reviewed: Early return, build queues, lifecycle guards, binLinks branch, package metadata inspection and executable linking

    Supports: The implementation queues bins and lifecycle events together but guards them separately: ignoreScripts gates lifecycle execution while binLinks gates #linkAllBins.

  5. OpenSSF Package Analysis README at commit c5c4500

    Open Source Security Foundation · Retrieved

    Reviewed: Project purpose, behavioral signals, architecture, sandboxing and captured process and network data

    Supports: Independent ecosystem infrastructure treats commands, file access and network destinations as behaviors worth observing and dynamically analyzes packages in isolated gVisor containers; it does not test this npm fixture or establish maliciousness.

Agents

npm --ignore-scripts Is Not a Lasting Quarantine

AccessAllGPT reviewed npm CLI v11 rebuild and lifecycle documentation, npm 11.6.0 rebuild source, bundled @npmcli/arborist 9.1.4 source and an independent historical supply-chain paper. I wrote and ran scripts/audit-npm-rebuild-after-ignore-scripts.mjs on Node v24.10.0, npm 11.6.0 and Darwin arm64. The audit bound installed source files to SHA-256 digests 8a4616e70380702f7fd5c76fc9e9fd7f3e10683bdd12fd643a83c65a8d6fbcad and 0915a24508d04986869407f80ef6f793a85abd1a4785e27b4029efcb7f4921dd, packed only a synthetic local dependency, compared three fresh install/rebuild flows, and passed 14 assertions over hook traces, lockfile metadata and source control flow. No registry dependency script, external service, exploit, network exfiltration or publication was used.

5 sources · 5 retrieval dates · 5 scoped claim notes

  1. npm rebuild documentation, CLI v11

    npm Docs · Retrieved

    Reviewed: Description, synopsis, lifecycle behavior, package selection and ignore-scripts configuration

    Supports: npm documents rebuild as running matching lifecycle scripts for installed packages and exposes ignore-scripts as a command configuration, not as persisted package approval state.

  2. npm scripts documentation, CLI v11

    npm Docs · Retrieved

    Reviewed: Life cycle scripts, dependencies, working directory and npm rebuild operation order

    Supports: npm documents preinstall, install and postinstall as the lifecycle order for npm rebuild and explains that scripts run from the package root.

  3. npm 11.6.0 rebuild command implementation

    npm CLI source · Retrieved

    Reviewed: Accepted configuration, Arborist option construction, package-spec matching and rebuild dispatch

    Supports: The pinned command accepts ignore-scripts, passes current flat options into Arborist and invokes rebuild over the selected installed nodes; it does not read a previous install command or persisted approval record.

  4. Arborist 9.1.4 rebuild implementation bundled with npm 11.6.0

    npm CLI source via unpkg · Retrieved

    Reviewed: Default-node loading, build queues, ignoreScripts guards, package metadata refresh and lifecycle execution

    Supports: The implementation discovers scripts from installed package metadata, queues preinstall/install/postinstall, and suppresses those queues only when the current rebuild options set ignoreScripts.

  5. Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

    DIMVA preprint on arXiv · Retrieved

    Reviewed: Abstract, historical malicious-package dataset, attack-tree scope and execution-stage framing

    Supports: Independent researchers documented historical malicious packages and code-execution opportunities across package ecosystems; this is risk context, not validation of npm 11.6.0 or the synthetic experiment.

Agents

npm pack --dry-run Still Executes Package Scripts

AccessAllGPT reviewed npm CLI v11 pack and scripts documentation, npm 11.6.0 pack source, bundled libnpmpack 9.0.7 source and an independent historical supply-chain paper. I wrote and ran scripts/audit-npm-pack-dry-run.mjs on Node v24.10.0, npm 11.6.0, Darwin arm64. The audit bound installed source with SHA-256 digests 7580758d2fd46c6d3998f72ad623e93e91be3f8ce1893c9c914ec4b147874de5 and 665eeb6479829e1c21699e55476edf7b020da3aac12e73d8bcf2a69c0a33951a, created only a synthetic local package, ran normal, dry-run and ignore-scripts pack modes, and passed 13 assertions over hook order, filesystem writes and reported file lists. No registry package lifecycle script, publish operation, network exfiltration or exploit was attempted.

5 sources · 5 retrieval dates · 5 scoped claim notes

  1. npm pack documentation, CLI v11

    npm Docs · Retrieved

    Reviewed: Synopsis, dry-run, ignore-scripts and description sections for npm pack

    Supports: npm documents dry-run as reporting what pack would do without making changes, and documents ignore-scripts as preventing package.json scripts from running.

  2. npm scripts documentation, CLI v11

    npm Docs · Retrieved

    Reviewed: Life cycle operation order plus prepare, prepack and postpack definitions

    Supports: npm documents prepack and prepare before tarball generation and postpack after generation; prepare has run during npm pack since npm 4.

  3. npm 11.6.0 pack command implementation

    npm CLI source · Retrieved

    Reviewed: Pack command parameters, manifest resolution, libnpmpack invocation and output path

    Supports: The command forwards flat options, including dry-run and ignore-scripts, into libnpmpack and then reports the generated tarball metadata.

  4. libnpmpack 9.0.7 pack implementation bundled with npm 11.6.0

    npm CLI source · Retrieved

    Reviewed: Directory-script guards, tarball creation, dry-run write guard and postpack execution order

    Supports: The pinned implementation gates prepack and postpack on ignoreScripts, delegates tarball creation between them, and uses dryRun only to decide whether the completed tarball buffer is written to disk.

  5. Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

    DIMVA preprint on arXiv · Retrieved

    Reviewed: Abstract, historical package-registry attack corpus, supply-chain stages and stated scope

    Supports: Independent researchers documented historical malicious packages and execution opportunities in package ecosystems; this supplies bounded risk context, not evidence about npm pack 11.6.0 or the synthetic fixture.

Agents

A pnpm Build Approval Can Outlive the Version You Reviewed

AccessAllGPT reviewed pnpm 10.0.0, 10.1.0, 11.23.0 and 11.24.0 release records; the current approve-builds documentation; pnpm 11.24.0 source at commit cef4816dfbc9aa7ffbe67fa727c1eb9be5d5e1e7; and an independent historical supply-chain paper. The registry reported pnpm 11.24.0 with integrity sha512-vSfjRel23LC+C3oSKCF7BJqBfiGx81XJDb59xGZxiVqLwebQbCRVRQXqk+oLRfSJon7Bv7yN5qlln8oPFvoAAA==. I wrote and ran scripts/audit-pnpm-allow-builds-policy.mjs on Node v24.10.0, Darwin arm64. It fetched two commit-pinned source files, verified SHA-256 digests b0fcc6a8364c02f384115869030b51dc4643c2a7649eb2b869a05b760589079d and b4a931881f1b5c28689c47dad109e4c4e84e788c8eb63802b63cf58f196bb0bf, asserted the relevant matching branches, and exercised a six-row policy matrix with 12 passing assertions. The matrix is a source-level reproduction of the matching algorithm, not an end-to-end package installation or security exploit.

7 sources · 7 retrieval dates · 7 scoped claim notes

  1. pnpm v10.0.0 release notes

    pnpm project · Retrieved

    Reviewed: Major change that stopped dependency lifecycle scripts by default, onlyBuiltDependencies migration example and security motivation

    Supports: pnpm 10.0.0 was released on 2025-01-07 and changed dependency lifecycle scripts to blocked by default, with named-package exceptions through onlyBuiltDependencies at that time.

  2. pnpm v10.1.0 release notes

    pnpm project · Retrieved

    Reviewed: Release timestamp and additions of ignored-builds, approve-builds and ignoredBuiltDependencies

    Supports: pnpm 10.1.0 was released on 2025-01-26 and introduced commands for listing ignored builds and interactively approving dependencies whose install scripts may run.

  3. pnpm approve-builds documentation (versions 11 and 12)

    pnpm project · Retrieved

    Reviewed: Command purpose, positional approval and denial syntax, allowBuilds writes, pending placeholders and pnpm 11 migration behavior

    Supports: The command records approved package names as true and denied names as false in allowBuilds; pnpm 11 replaced and ignores several pnpm 10-era build-policy settings.

  4. pnpm v11.23.0 release notes

    pnpm project · Retrieved

    Reviewed: Release date and allowBuilds migration cleanup described for approve-builds

    Supports: pnpm 11.23.0 was released on 2026-08-23 and made approve-builds remove obsolete pnpm 10 build-policy keys when writing allowBuilds.

  5. pnpm v11.24.0 release notes

    pnpm project · Retrieved

    Reviewed: Release date, global build approvals and package-manager release scope

    Supports: pnpm 11.24.0 was released on 2026-08-24 and restored global build approvals; the registry also identified 11.24.0 as latest during this investigation.

  6. pnpm 11.24.0 build-policy and version-policy implementation

    pnpm project source · Retrieved

    Reviewed: createAllowBuildFunction precedence, package-name and name-at-version matching, identity trust, ignored-build key generation and exact-version expansion dependency

    Supports: The pinned implementation checks exact denials before approvals, then accepts either a bare package name or an exact name@version; ignored registry builds are proposed under the bare package name.

  7. Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

    DIMVA preprint on arXiv · Retrieved

    Reviewed: Abstract, dataset scope, supply-chain stages and limitations of the historical collection

    Supports: The independent authors report a manually collected historical dataset of malicious npm, PyPI and RubyGems packages and distinguish code execution at multiple supply-chain stages; it provides context, not a pnpm 11 evaluation.