ShieldCortex

The declared audit paths and local memory storage fit the integration. Inspected cloud senders require cloud enablement plus an API key and strip content previews. Transcript capture and optional full-memory sync are disclosed. Several scanner matches quote explicit denials of credential access or automatic approval; those matches do not establish the alleged behavior.

runtime.mjs invokes unversioned npx mcporter and falls back to npx -y shieldcortex when no local server binary is available. Hook execution can therefore resolve mutable registry code with local-user access. This is disclosed, but no reviewed version is enforced. The documented manual update command alone is not evidence of malicious self-modification.

index.js normaliseConfig discards interceptor settings before initialization, defeating configured approval controls. Isolated checks confirmed that default BLOCK and QUARANTINE results neither deny the call nor request approval. The separate X-Ray guard still blocks matching patterns; actual storage also depends on the receiving memory tool’s protections. Active interception itself is disclosed.

Bootstrap self-heal defaults to enabled, including with unreadable configuration. It recursively deletes two fixed legacy hook directories without backup and can overwrite existing canonical hook files without checking for customizations. The behavior is bounded, documented and disableable, which reduces the concern, but recovery and overwrite safeguards are absent. Full handler inspection resolved the scanner’s incomplete-analysis concern.

Persistent memory, transcript extraction and security audits fit the stated purpose and the [publisher’s public project](https://github.com/Drakon-Systems-Ltd/ShieldCortex). Declared agent-config and .env access is purpose-aligned, rather than evidence of credential theft.