@atlisp/mcp@1.11.0

⚠ Under review

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The inspected persistence setup is behind an explicit command, and automatic CAD launching is configuration-guarded. The selected edge-js dependency remained unresolved, so the review cannot establish a clean result.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Loading the bundled entrypoint, which imports edge-js for CAD instance discovery.

Impact

The dependency’s runtime behavior cannot be assessed from the inspected source.

Mechanism

The package passes a bundled DLL path to edge-js; the dependency source was unavailable for inspection.

AI rationale

Evidence

package.jsondist/atlisp-mcp.js

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares edge-js as a runtime dependency, and the bundled entrypoint imports it to load a CAD ROT helper DLL.
The entrypoint’s automatic CAD launch is guarded by configuration; persistent startup registration runs only for the explicit --install-autostart option.

Evidence against

The source for the selected edge-js dependency could not be resolved for inspection, so its runtime behavior remains unknown.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 1.58 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

9 flagged

dist/atlisp-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.9.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1224}); L1225: import { spawn } from "child_process"; L1226: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1224

25199const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L25200: return `powershell -WindowStyle Hidden -Command "${base}"`; L25201: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L25199

90const raw = fs.readFileSync(filePath, "utf-8"); L91: const parsed = JSON.parse(raw); L92: const result = configSchema.safeParse(parsed); ... L185: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L186: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L187: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L341: cliArgs = parseArgs(); L342: envResult = envSchema.safeParse(process.env); L343: if (!envResult.success) { ... L347: env = envResult.data; L348: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L349: fileConfig = loadConfigFile(configFilePath);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L90

90Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L90: const raw = fs.readFileSync(filePath, "utf-8"); L91: const parsed = JSON.parse(raw); L92: const result = configSchema.safeParse(parsed); ... L185: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L186: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L187: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L341: cliArgs = parseArgs(); L342: envResult = envSchema.safeParse(process.env); L343: if (!envResult.success) { ... L347: env = envResult.data; L348: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L349: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L90

90Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L90: const raw = fs.readFileSync(filePath, "utf-8"); L91: const parsed = JSON.parse(raw); L92: const result = configSchema.safeParse(parsed); ... L185: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L186: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L187: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L341: cliArgs = parseArgs(); L342: envResult = envSchema.safeParse(process.env); L343: if (!envResult.success) { ... L347: env = envResult.data; L348: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L349: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L90

1064try { L1065: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L1066: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L1064

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L90

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 27136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

9 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1224}); L1225: import { spawn } from "child_process"; L1226: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1224

25199const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L25200: return `powershell -WindowStyle Hidden -Command "${base}"`; L25201: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L25199

Findings

1 Critical5 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

MediumShips Native Binarydist/cad-rothelper.dll

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @atlisp/mcp@1.11.0.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.11.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 02:53:30.313Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.