@atlisp/mcp@1.11.1
MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP
AI Security Review
scanned 23h ago · by lpm-firewall-aiThe default network binding and empty API key expose administrative CAD/LISP operations to reachable clients, a concrete security risk. The source includes a warning, but the unsafe defaults remain; the result is a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The server starts with its default host and API key settings, and a network client can reach the bound address.
Impact
A reachable unauthenticated client can perform CAD/LISP operations through the server.
Mechanism
The default host is 0.0.0.0 and the API key is empty; with authentication unconfigured, the source assigns the admin role and starts the listener.
AI rationale
The default network binding and empty API key expose administrative CAD/LISP operations to reachable clients, a concrete security risk. The source includes a warning, but the unsafe defaults remain; the result is a warning rather than a block.
Evidence
package.jsondist/atlisp-mcp.js
Network endpoints1
0.0.0.0
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The package entrypoint loads the bundled server, whose default HTTP configuration binds to 0.0.0.0 with no API key.
- When authentication is absent, the server assigns the admin role; its own warning says reachable network clients can perform CAD/LISP operations.
- The server listens on the configured host and port, so the unauthenticated default exposes those operations beyond loopback.
Evidence against
- The source warns about unauthenticated non-loopback access and recommends configuring an API key or binding to loopback.
- Autostart installation is activated through an explicit command-line option.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcedist/atlisp-mcp.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @atlisp/mcp@1.9.2
matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2
similarity = 0.643
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/atlisp-mcp.jsView on unpkg1224});
L1225: import { spawn } from "child_process";
L1226: import path4 from "path";
High
Child Process
Package source references child process execution.
dist/atlisp-mcp.jsView on unpkg · L122426138const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`;
L26139: return `powershell -WindowStyle Hidden -Command "${base}"`;
L26140: }
High
Findings
1 Critical5 High6 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js
HighChild Processdist/atlisp-mcp.js
HighShelldist/atlisp-mcp.js
HighCommand Output Exfiltrationdist/atlisp-mcp.js
HighSpawned Bundled Service Listenerdist/atlisp-mcp.js
HighTrigger Reachable Persistencedist/atlisp-mcp.js
MediumDynamic Requiredist/atlisp-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/atlisp-mcp.js
MediumShips Native Binarydist/cad-rothelper.dll
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @atlisp/mcp@1.11.1.
See all versions of @atlisp/mcp for other recorded verdicts.
- Review the evidence and your use of @atlisp/mcp@1.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.