Security audit

Neotoma

Security checks for vulnerabilities and agentic risk

Overview

Neotoma appears to be a legitimate memory/MCP server, but it recommends broad workspace inspection and can persistently modify agent rule files, so users should review its setup and data boundaries carefully.

Install only if you want a persistent cross-agent memory layer. Before setup, narrow any agent prompts to specific files or projects, inspect any .cursor/.claude/.codex rules it proposes or updates, pin the npm package version if possible, and verify where data, tokens, embeddings, exports, and deletion controls live.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/cli/index.js:592
Evidence: const child = spawn(process.argv[0], [process.argv[1], "init"], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/cli/mcp_config_scan.js:889
Evidence: execSync("npm run sync:mcp", {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/mcp_ws_bridge.js:89
Evidence: child = spawn(MCP_CMD, MCP_ARGS, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/services/schema_registry.js:1029
Evidence: const child = spawn("tsx", [scriptPath], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/shared/local_transport.js:63
Evidence: localApiChild = spawn(process.execPath, [actionsPath], {

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/cli/index.js:87
Evidence: process.env.NEOTOMA_USE_READLINE === "1" ||

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/services/mcp_oauth.js:36
Evidence: const ENCRYPTION_KEY = process.env.NEOTOMA_MCP_TOKEN_ENCRYPTION_KEY ||

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/shared/local_transport.js:66
Evidence: ...process.env,

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/actions.js:1418
Evidence: const bearerToken = [REDACTED]("Bearer ".length).trim();

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/cli/index.js:1193
Evidence: access_token: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/crypto/auth.js:16
Evidence: const bearerToken = [REDACTED](keyPair.publicKey);

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/crypto/keys.js:11
Evidence: const privateKey = [REDACTED]();

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/embeddings.js:4
Evidence: ? new OpenAI({ apiKey: [REDACTED] })

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/openclaw_entry.js:24
Evidence: process.env.OPENAI_API_KEY = [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/services/llm_extraction.js:20
Evidence: ? new OpenAI({ apiKey: [REDACTED] })

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/services/mcp_oauth.js:751
Evidence: accessToken: [REDACTED]("local_access"),

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/services/oauth_key_gate.js:65
Evidence: const bearerToken = [REDACTED]?.trim() || "";

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/services/oauth_state.js:12
Evidence: bearerToken: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/services/schema_icon_service.js:13
Evidence: ? new OpenAI({ apiKey: [REDACTED] })

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/services/schema_recommendation.js:505
Evidence: const openai = new OpenAI({ apiKey: [REDACTED] });