@atlisp/mcp@1.11.2

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package exposes a bundled runtime, but the inspected persistence behavior requires an explicit user command, and the remote skill content is written as Markdown. The scanner's remote execution and persistence hints were not supported by the inspected source behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the CLI with --install-autostart registers autostart; invoking the skill install function downloads a skill.

Impact

No confirmed attack surface was established from these behaviors.

Mechanism

The autostart command creates a platform startup entry. The skill installer fetches text and writes it to a Markdown file; no execution of that text was found in the inspected flow.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points the CLI and module entrypoints to the bundled runtime.
Autostart registration runs only when the user supplies the explicit --install-autostart flag.
The skill installer fetches text and saves it as a Markdown file; the inspected flow does not execute that content.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 1.73 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

12 flagged

dist/atlisp-mcp.jsView file

84const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L184: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L185: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L186: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L342: cliArgs = parseArgs(); L343: envResult = envSchema.safeParse(process.env); L344: if (!envResult.success) { ... L348: env = envResult.data; L349: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L350: fileConfig = loadConfigFile(configFilePath);

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/atlisp-mcp.jsView on unpkg · L84

84Trigger-reachable chain: manifest.main -> dist/atlisp-mcp.js L84: const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L184: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L185: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L186: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L342: cliArgs = parseArgs(); L343: envResult = envSchema.safeParse(process.env); L344: if (!envResult.success) { ... L348: env = envResult.data; L349: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L350: fileConfig = loadConfigFile(configFilePath);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/atlisp-mcp.jsView on unpkg · L84

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.9.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2 similarity = 0.619 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

6855}); L6856: import { spawn } from "child_process"; L6857: import path5 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L6855

27108const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L27109: return `powershell -WindowStyle Hidden -Command "${base}"`; L27110: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L27108

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L84

84Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L84: const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L184: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L185: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L186: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L342: cliArgs = parseArgs(); L343: envResult = envSchema.safeParse(process.env); L344: if (!envResult.success) { ... L348: env = envResult.data; L349: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L350: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L84

84Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L84: const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L184: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L185: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L186: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L342: cliArgs = parseArgs(); L343: envResult = envSchema.safeParse(process.env); L344: if (!envResult.success) { ... L348: env = envResult.data; L349: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L350: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L84

1077try { L1078: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L1079: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L1077

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L84

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/atlisp-mcp.jsView on unpkg · L84

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 27136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

12 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/atlisp-mcp.jsView on unpkg · L84

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

3 Critical5 High6 Medium6 Low

CriticalRemote Asset Decode Executedist/atlisp-mcp.js

CriticalTrigger Reachable Dangerous Capabilitydist/atlisp-mcp.js

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

Medium

Affected versions and remediation

This report applies to @atlisp/mcp@1.11.2.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.11.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 02:03:15.056Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.