FastFix AI (@FastfixAI) on X

What it is

A thread from FastFix AI (@FastfixAI) on X giving six pre-install checks for any plugin, MCP server or skill added to a coding agent. It opens with an account of a builder whose agent reviewed a repo with over 300K GitHub stars. The agent found that the install adds a code-injection toolkit and writes to Claude Code, Codex and Copilot configs automatically. The thread does not name the repo.

What to do

Review the repo without running it. Clone it into an empty folder and give the agent this prompt:

Review this repo. Don't install, build or run anything. List install scripts, network calls, files it writes outside this folder, bundled binaries and any edits to agent configs.

Inspect npm packages before installing. If a postinstall step is unclear, install with --ignore-scripts or skip the package.

npm view some-package scripts

Check that the package points at the official repo. Compare the output of this command with the official repo, and be wary of brand-new orgs and forks that ship binaries.

npm view some-package repository

Pin the exact version with npm install --save-exact and turn off auto-updates. If a skill tells the agent to fetch the newest release "for repairs", the thread calls that a remote update channel into your machine and says to delete the line.

Copy ~/.claude (or the agent's config folder) before installing, then diff it afterwards. claude mcp add defaults to local scope, so the server loads only in the current project. The thread advises holding off on --scope user until the server is trusted.

Control token cost and permissions. The thread says the repo's 173 tools could cost about 120K tokens per request if the client loads them all. Run /context in Claude Code to see usage and switch off idle servers in /mcp. Never combine --dangerously-skip-permissions with tools that run code.

Caveats

The thread gives one lookalike example: a copy of the same repo shipped a Windows .exe that Defender flagged as a trojan. The repo is unnamed, and the thread cites no source for the agent's findings. The token figure is conditional on the client loading all tools. The closing note cites the MCP security best-practices doc: local servers run with the client's privileges, so a malicious startup command can run arbitrary code. That doc recommends that clients show the exact command before running it and sandbox servers.