Loading npm security reports…
A spec-driven senior developer agent CLI & MCP server
Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
dist/mcp/server.js exposes run_agent_command, passing arbitrary tool input to child_process.exec.
dist/mcp/server.jsView on unpkgdist/cli/mcp-register.js can register the server in global Claude, Cline, Roo, and Cursor MCP configs when explicitly invoked.
dist/cli/mcp-register.jsView on unpkgdist/mcp/router.js starts user-configured MCP commands and forwards the inherited environment.
dist/mcp/router.jsView on unpkgdist/cli/design.js sends a user-supplied/stored Figma token to Figma APIs.
dist/cli/design.jsView on unpkgdist/mcp/server.js exposes run_agent_command, passing arbitrary tool input to child_process.exec.
dist/mcp/server.jsView on unpkgdist/cli/mcp-register.js can register the server in global Claude, Cline, Roo, and Cursor MCP configs when explicitly invoked.
dist/cli/mcp-register.jsView on unpkgdist/mcp/router.js starts user-configured MCP commands and forwards the inherited environment.
dist/mcp/router.jsView on unpkgdist/cli/design.js sends a user-supplied/stored Figma token to Figma APIs.
dist/cli/design.jsView on unpkg