@atlisp/mcp@1.9.3

⚠ Under review

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The source shows product-aligned health reporting and user-invoked autostart setup, with no confirmed attack behavior. The selected edge-js dependency source was unresolved, and it is used to load a native helper, so the package cannot be cleared from this inspection.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The unresolved behavior is relevant when the CAD helper is loaded during runtime use.

Impact

The helper’s behavior cannot be assessed from the inspected source, so benignness is not established.

Mechanism

The bundle passes the helper DLL to edge-js; the dependency source was unavailable in the bounded inspection.

AI rationale

Evidence

package.jsondist/atlisp-mcp.jsdist/cad-rothelper.dll

Decision evidence

public snapshot

AI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares edge-js, and the bundled runtime uses it to load the CAD helper DLL; the selected dependency source was unresolved in the supplied inspection record.
The bundle sends hostname or configured client ID and CAD health metrics to its health-reporting endpoint when the server starts.
The bundle exposes a native DLL helper whose behavior could not be established from the inspected JavaScript source.

Evidence against

The only manifest lifecycle hook is prepublishOnly, which runs build scripts.
Autostart persistence is activated by an explicit --install-autostart command.
Health reporting sends operational status and CAD metrics to the package’s service endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

9 flagged

dist/atlisp-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.9.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1132}); L1133: import { spawn } from "child_process"; L1134: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1132

22855const baseCmd = getStartupCommand(); L22856: const psCmd = `powershell -WindowStyle Hidden -Command "${baseCmd}"`; L22857: try {

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22855

87const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L87

87Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L87

87Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L87

972try { L973: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L974: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L972

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L87

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 22016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

9 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1132}); L1133: import { spawn } from "child_process"; L1134: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1132

22855const baseCmd = getStartupCommand(); L22856: const psCmd = `powershell -WindowStyle Hidden -Command "${baseCmd}"`; L22857: try {

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22855

Findings

1 Critical5 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

MediumShips Native Binarydist/cad-rothelper.dll

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @atlisp/mcp@1.9.3.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.9.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 02:53:08.693Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.