registry / @4da/mcp-server / 4.6.6

@4da/mcp-server@4.6.6

Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 378 KB of source, external domains: 4da.ai, api.anthropic.com, api.npmjs.org, api.openai.com, api.osv.dev, github.com, hn.algolia.com, index.crates.io, news.ycombinator.com, proxy.golang.org, pypi.org, registry.npmjs.org

Source & flagged code

1 flagged

dist/db.jsView file

Lines 1-34javascript

1// SPDX-License-Identifier: Apache-2.0

2/**

3 * Database module for 4DA MCP Server

4 *

5 * Read-only access to the 4DA SQLite database.

6 * Only the record_feedback function performs writes.

7 */

8import path from "path";

Source & flagged code

1 flagged · loading source

dist/db.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code