registry / @4da/mcp-server / 4.6.6

@4da/mcp-server@4.6.6

Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 378 KB of source, external domains: 4da.ai, api.anthropic.com, api.npmjs.org, api.openai.com, api.osv.dev, github.com, hn.algolia.com, index.crates.io, news.ycombinator.com, proxy.golang.org, pypi.org, registry.npmjs.org

Source & flagged code

1 flagged

dist/db.jsView file

Lines 1-34javascript

1// SPDX-License-Identifier: Apache-2.0

2/**

3 * Database module for 4DA MCP Server

4 *

5 * Read-only access to the 4DA SQLite database.

6 * Only the record_feedback function performs writes.

7 */

8import path from "path";

9import * as fs from "fs";

10import * as os from "os";

11import { fileURLToPath } from "node:url";

12import { dirname } from "node:path";

13let Database;

14try {

15 Database = (await import("better-sqlite3")).default;

16}

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/db.jsView on unpkg · L14

17catch (err) {

18 const msg = err instanceof Error ? err.message : String(err);

19 console.error("\n [4DA] Failed to load better-sqlite3 native bindings.\n\n" +

20 " This usually means your system is missing C++ build tools.\n" +

21 " Install the appropriate tools for your platform:\n\n" +

22 " macOS: xcode-select --install\n" +

23 " Ubuntu: sudo apt install build-essential python3\n" +

24 " Windows: npm install -g windows-build-tools\n\n" +

25 ` Error: ${msg}\n\n` +

26 " After installing build tools, run: npm rebuild better-sqlite3\n");

27 process.exit(1);

28}

29const __filename = fileURLToPath(import.meta.url);

30const __dirname = dirname(__filename);

31/**

32 * Resolve the database path by checking multiple locations in priority order:

33 * 1. FOURDA_DB_PATH env var

34 * 2. data/4da.db relative to cwd (development)

Source & flagged code

1 flagged · loading source

dist/db.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code