com.atagon/kogiqa-mcpweb-automation

kogiQA MCP Web Browser

Flagged

This web browser has been designed to help your agent debug and develop complex web applications.

Our take

Audit found install-time behavior no MCP package should have: its npm postinstall script silently detects every coding agent on your machine (Claude Code, Cursor, etc.) and writes itself into each one's MCP config without asking, then downloads and unpacks a ~280MB closed-source Electron browser binary from the vendor's server. The registry entry lists no repository; the GitHub repo appeared on 2026-07-02 (two days after the npm package) and holds installer glue, not the browser's source. Add 848 downloads in the package's first five days with no community footprint, and the picture is a self-propagating, unauditable install rather than a trustworthy tool.

reviewed by hand · 2026-07-05

Something wrong or dead here? Report it

Verification record

last verified: yesterday
npm: kogiqa-mcp
downloads / wk: 848
latest version: 1.3.29
in registry since: 2026-07-02