registry / @atlisp/mcp / 1.8.25
@atlisp/mcp@1.8.25
MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete malicious install-time behavior, credential theft, or stealth persistence was found. The runtime plugin lifecycle and broad network/CAD capability warrant a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
Running the `atlisp-mcp` CLI with HTTP transport; plugin execution occurs when `~/.atlisp/mcp-plugins` contains JavaScript files.
Impact
A party able to place a plugin in the package-owned directory could obtain code execution in the MCP server process; the service exposes CAD-control capabilities when reachable.
Mechanism
runtime MCP listener, vendor health reporting, and package-owned plugin lifecycle loading
AI rationale
No concrete malicious install-time behavior, credential theft, or stealth persistence was found. The runtime plugin lifecycle and broad network/CAD capability warrant a warning rather than a block.
Evidence
package.jsondist/atlisp-mcp.jsdist/cad-worker.jsdist/config.jsdist/handlers/skill-handlers.jsdist/cad-rothelper.dll~/.atlisp/mcp-plugins~/.atlisp/skills
Network endpoints3
atlisp.cn/api/mcp/healths3.atlisp.cn/json/functions.jsons3.atlisp.cn/packages-list?fmt=json
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `dist/atlisp-mcp.js` starts an HTTP/WebSocket MCP service on configurable host, default `0.0.0.0`.
- `dist/atlisp-mcp.js` auto-loads and watches executable plugins from `~/.atlisp/mcp-plugins` at runtime.
- `dist/atlisp-mcp.js` posts periodic hostname/CAD/system health metadata to `https://atlisp.cn/api/mcp/health`.
- `dist/handlers/skill-handlers.js` explicitly downloads selected registry skills into `~/.atlisp/skills`.
- `dist/cad-worker.js` loads the bundled `dist/cad-rothelper.dll` through `edge-js` for CAD integration.
Evidence against
- `package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook; only `prepublishOnly` builds publisher artifacts.
- The child process only launches the bundled `cad-worker.js` for CAD IPC.
- No source evidence of credential harvesting, reading SSH/npm/AI-agent configuration, or secret exfiltration.
- Plugin and skill writes are confined to package-owned `~/.atlisp` paths and require runtime or explicit tool use.
Behavioral surface
ChildProcessCrypto
Source & flagged code
4 flagged · loading sourcedist/atlisp-mcp.jsView file
543});
L544: import { spawn } from "child_process";
L545: import path2 from "path";
High
Child Process
Package source references child process execution.
dist/atlisp-mcp.jsView on unpkg · L54377Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener.
L77: const raw = fs.readFileSync(filePath, "utf-8");
L78: const parsed = JSON.parse(raw);
L79: const result = configSchema.safeParse(parsed);
...
L123: ENABLE_CORS: z.coerce.boolean().optional().default(true),
L124: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"),
L125: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4),
...
L195: cliArgs = parseArgs();
L196: envResult = envSchema.safeParse(process.env);
L197: if (!envResult.success) {
...
L201: env = envResult.data;
L202: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json");
L203: fileConfig = loadConfigFile(configFilePath);
High
Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist/atlisp-mcp.jsView on unpkg · L771294__dirname2 = path3.dirname(fileURLToPath2(import.meta.url));
L1295: require2 = createRequire(import.meta.url);
L1296: ({ version } = require2(path3.join(__dirname2, "..", "package.json")));
Findings
3 High5 Medium6 Low
HighChild Processdist/atlisp-mcp.js
HighShell
HighSpawned Bundled Service Listenerdist/atlisp-mcp.js
MediumDynamic Requiredist/atlisp-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/cad-rothelper.dll
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @atlisp/mcp@1.8.25.
See all versions of @atlisp/mcp for other recorded verdicts.
- Review the evidence and your use of @atlisp/mcp@1.8.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.