@atlisp/mcp@1.11.3

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source inspection found no malicious lifecycle behavior or concrete attack chain. The flagged persistence, dynamic loading, and network activity are tied to explicit setup, local plugins, user-requested skill installation, or package-aligned runtime reporting.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Starting the server enables error reporting; persistence setup and skill installation require explicit commands or tool requests.

Impact

The inspected flows do not establish credential theft, unconsented persistence, or remote payload execution.

Mechanism

Error reports are posted to the package’s Atlisp endpoint. The inspected skill flow stores fetched content as Markdown, and plugins are loaded from the local plugin directory.

AI rationale

Evidence

package.jsondist/atlisp-mcp.js

Network endpoints1

atlisp.cn/api/error/report

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes the bundled server and its prepublishOnly script only runs the build.
Persistence setup requires the explicit --install-autostart command.
Runtime error reports go to the package’s Atlisp endpoint and contain error metadata and runtime context.
The skill flow fetches content for an install request and writes it as a Markdown file.
Plugins are dynamically imported from the local plugin directory.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 1.74 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

12 flagged

dist/atlisp-mcp.jsView file

84const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L189: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L190: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L191: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L352: cliArgs = parseArgs(); L353: envResult = envSchema.safeParse(process.env); L354: if (!envResult.success) { ... L358: env = envResult.data; L359: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L360: fileConfig = loadConfigFile(configFilePath);

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/atlisp-mcp.jsView on unpkg · L84

84Trigger-reachable chain: manifest.main -> dist/atlisp-mcp.js L84: const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L189: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L190: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L191: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L352: cliArgs = parseArgs(); L353: envResult = envSchema.safeParse(process.env); L354: if (!envResult.success) { ... L358: env = envResult.data; L359: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L360: fileConfig = loadConfigFile(configFilePath);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/atlisp-mcp.jsView on unpkg · L84

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.11.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.11.2 similarity = 0.948 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

6881}); L6882: import { spawn } from "child_process"; L6883: import path5 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L6881

27301const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L27302: return `powershell -WindowStyle Hidden -Command "${base}"`; L27303: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L27301

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L84

84Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L84: const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L189: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L190: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L191: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L352: cliArgs = parseArgs(); L353: envResult = envSchema.safeParse(process.env); L354: if (!envResult.success) { ... L358: env = envResult.data; L359: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L360: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L84

84Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L84: const raw = fs.readFileSync(filePath, "utf-8"); L85: const parsed = JSON.parse(raw); L86: const result2 = configSchema.safeParse(parsed); ... L189: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L190: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L191: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L352: cliArgs = parseArgs(); L353: envResult = envSchema.safeParse(process.env); L354: if (!envResult.success) { ... L358: env = envResult.data; L359: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L360: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L84

1103try { L1104: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L1105: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L1103

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L84

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/atlisp-mcp.jsView on unpkg · L84

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 27136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

12 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/atlisp-mcp.jsView on unpkg · L84

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

3 Critical5 High6 Medium6 Low

CriticalRemote Asset Decode Executedist/atlisp-mcp.js

CriticalTrigger Reachable Dangerous Capabilitydist/atlisp-mcp.js

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

Medium

Affected versions and remediation

This report applies to @atlisp/mcp@1.11.3.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.11.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 11:04:01.109Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.