registry / @ainecto/mcp / 0.1.4

@ainecto/mcp@0.1.4

Ainecto MCP connector and first-party CLI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 260 KB of source, external domains: 127.0.0.1, ainecto.com, dev.ainecto.com

Source & flagged code

2 flagged

dist/bin/ainecto.jsView file

Lines 60-101javascript

60 return createHash("sha256").update(endpoint).digest("hex");

61}

62function isNodeError(error, code) {

63 return error instanceof Error && "code" in error && error.code === code;

64}

65async function chmodIfPermissive(path, mode) {

66 try {

67 const result = await stat(path);

68 if ((result.mode & 63) !== 0) {

69 await chmod(path, mode);

70 }

71 } catch (error) {

72 if (isNodeError(error, "ENOENT")) {

73 return;

74 }

75 throw error;

76 }

77}

79// src/core/auth/oauth.ts

80import { createHash as createHash2, randomBytes } from "crypto";

81import { createServer } from "http";

82import { spawn } from "child_process";

83import { URLSearchParams } from "url";

High

Child Process

Package source references child process execution.

dist/bin/ainecto.jsView on unpkg · L81

85// src/core/config/endpoints.ts

86var DEFAULT_ENDPOINTS = {

87 prod: "https://ainecto.com/mcp",

88 dev: "https://dev.ainecto.com/mcp"

89};

90function resolveEndpoint(input = {}) {

91 const envVars = input.envVars ?? process.env;

92 const env = input.env ?? "prod";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/ainecto.jsView on unpkg · L80

93 if (input.endpoint) {

94 return { env, endpoint: normalizeEndpoint(input.endpoint), source: "flag" };

95 }

96 if (envVars.AINECTO_MCP_ENDPOINT) {

97 return { env, endpoint: normalizeEndpoint(envVars.AINECTO_MCP_ENDPOINT), source: "env" };

98 }

99 return { env, endpoint: DEFAULT_ENDPOINTS[env], source: "default" };

100}

101function normalizeEndpoint(endpoint) {

Source & flagged code

2 flagged · loading source

dist/bin/ainecto.jsView file

81import { createServer } from "http"; L82: import { spawn } from "child_process"; L83: import { URLSearchParams } from "url";

High

Child Process

Package source references child process execution.

dist/bin/ainecto.jsView on unpkg · L81

80import { createHash as createHash2, randomBytes } from "crypto"; L81: import { createServer } from "http"; L82: import { spawn } from "child_process"; L83: import { URLSearchParams } from "url"; ... L90: function resolveEndpoint(input = {}) { L91: const envVars = input.envVars ?? process.env; L92: const env = input.env ?? "prod";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/ainecto.jsView on unpkg · L80

Findings

3 High2 Medium5 Low

HighChild Processdist/bin/ainecto.js

HighShell

HighSame File Env Network Executiondist/bin/ainecto.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/bin/ainecto.jsView file

Lines 60-101javascript

60 return createHash("sha256").update(endpoint).digest("hex");

61}

62function isNodeError(error, code) {

63 return error instanceof Error && "code" in error && error.code === code;

64}

65async function chmodIfPermissive(path, mode) {

66 try {

67 const result = await stat(path);

68 if ((result.mode & 63) !== 0) {

69 await chmod(path, mode);

70 }

71 } catch (error) {

72 if (isNodeError(error, "ENOENT")) {

73 return;

74 }

75 throw error;

76 }

77}

79// src/core/auth/oauth.ts

80import { createHash as createHash2, randomBytes } from "crypto";

81import { createServer } from "http";

82import { spawn } from "child_process";

83import { URLSearchParams } from "url";

High

Child Process

Package source references child process execution.

dist/bin/ainecto.jsView on unpkg · L81

85// src/core/config/endpoints.ts

86var DEFAULT_ENDPOINTS = {

87 prod: "https://ainecto.com/mcp",

88 dev: "https://dev.ainecto.com/mcp"

89};

90function resolveEndpoint(input = {}) {

91 const envVars = input.envVars ?? process.env;

92 const env = input.env ?? "prod";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/ainecto.jsView on unpkg · L80

93 if (input.endpoint) {

94 return { env, endpoint: normalizeEndpoint(input.endpoint), source: "flag" };

95 }

96 if (envVars.AINECTO_MCP_ENDPOINT) {

97 return { env, endpoint: normalizeEndpoint(envVars.AINECTO_MCP_ENDPOINT), source: "env" };

98 }

99 return { env, endpoint: DEFAULT_ENDPOINTS[env], source: "default" };

100}

101function normalizeEndpoint(endpoint) {