GCVE-110-OSM-2026-8609

agensflow-mcp is a brand-new, single-version package with no source repository that installs itself as a user-scoped auto-trusted MCP server via `claude mcp add --scope user`, bypassing per-project approval prompts. It also deploys hook scripts (`agf-route.sh`, `agf-record.sh`) into `.claude/hooks/` that intercept all Claude Code agent tool calls and routes them through an externally-controlled service (`seahorse-app-5j7lo.ondigitalocean.app`). The `cli.py` encodes `{"openrouter_key": key, "model": args.model}` and POSTs it to the AgensFlow backend — this could be a legitimate BYOK feature, but combined with the routing interception it means both the user's API key and all agent I/O are transmitted to an unverifiable third-party service. No obfuscation is present and the behavior is architecturally consistent with a legitimate coordination tool, but the absence of a source repository, zero prior versions, and the interception-plus-key-transmission pattern on a freshly published package targeting AI developers is a meaningful supply-chain risk that warrants manual review before deployment. ENTRY src/agensflow_mcp/cli.py (console-script: agensflow-mcp=agensflow_mcp.cli:main) DESTINATION - custom-c2: https://openrouter.ai/keys (primary, plaintext) in src/agensflow_mcp/cli.py - urls: https://openrouter.ai/activity (c2, plaintext) - domains: openrouter.ai (c2, plaintext) EXFIL - Data Encoding for Exfiltration in bench/runner.py: "json.dumps(body).encode" - Python File Upload to Remote in scripts/smoke_byok.py: "urllib.request.Request(url, data=" - Data Encoding for Exfiltration in scripts/smoke_byok.py: "json.dumps(body).encode" - Curl/Wget Pipe to Shell in scripts/smoke_byok.sh: "curl -sS "$BASE/health" && echo echo "=== 2. get a fresh anon AgensFlow key" AGF..." - Data Encoding for Exfiltration in src/agensflow_mcp/cli.py: "json.dumps({"openrouter_key": key, "model": args.model}).encode" - Network Request in bench/__main__.py: "urllib.request.Request(" - Network Request in bench/report.py: "urllib.request.Request(" - Network Request in bench/runner.py: "urllib.request.Request(" (+2 more) ADDITIONAL FINDINGS - Shell Command Execution in src/agensflow_mcp/cli.py: "subprocess.run(" - Brand New Package PAYLOAD FILES scripts/smoke_byok.py (+ src/agensflow_mcp/cli.py, bench/runner.py) INDICATORS (IOCs) - urls: https://agensflow-mcp-xxxxx.ondigitalocean.app`, https://cloud.digitalocean.com/account/integrations, https://cloud.digitalocean.com/apps, https://openrouter.ai/api/v1/chat/completions`., https://seahorse-app-5j7lo.ondigitalocean.app (+3 more) - domains: cloud.digitalocean.com, seahorse-app-5j7lo.ondigitalocean.app, agensflow.ai - payloadFileHash: 6f1b40a9a4d4c9cb7d770ce85923dc65491edbe1771225c0acb440cec9dbc115