@atlisp/mcp@1.8.28

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 1.12 MB of source, external domains: api.openai.com, atlisp.cn, raw.githubusercontent.com, s3.atlisp.cn

Source & flagged code

4 flagged

dist/atlisp-mcp.jsView file

543}); L544: import { spawn } from "child_process"; L545: import path2 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L543

77Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L77: const raw = fs.readFileSync(filePath, "utf-8"); L78: const parsed = JSON.parse(raw); L79: const result = configSchema.safeParse(parsed); ... L123: ENABLE_CORS: z.coerce.boolean().optional().default(true), L124: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L125: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L195: cliArgs = parseArgs(); L196: envResult = envSchema.safeParse(process.env); L197: if (!envResult.success) { ... L201: env = envResult.data; L202: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L203: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L77

1299__dirname2 = path3.dirname(fileURLToPath2(import.meta.url)); L1300: require2 = createRequire(import.meta.url); L1301: ({ version } = require2(path3.join(__dirname2, "..", "package.json")));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L1299

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 22016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

4 flagged · loading source

dist/atlisp-mcp.jsView file

543}); L544: import { spawn } from "child_process"; L545: import path2 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L543

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L77

1299__dirname2 = path3.dirname(fileURLToPath2(import.meta.url)); L1300: require2 = createRequire(import.meta.url); L1301: ({ version } = require2(path3.join(__dirname2, "..", "package.json")));

Findings

3 High5 Medium6 Low

HighChild Processdist/atlisp-mcp.js

HighShell

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/cad-rothelper.dll

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @atlisp/mcp@1.8.28.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.8.28 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-13 04:47:40.249Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.