registry / Remote code execution / @atlisp/mcp / 1.9.4

@atlisp/mcp@1.9.4

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 23h ago · by lpm-firewall-ai

Source confirms a serious default exposure: the HTTP service binds to all interfaces while requests receive admin access when no key is configured. The autostart persistence path requires an explicit CLI command, so it does not establish unconsented installation-time persistence or malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user starts the default HTTP server without setting an API key.

Impact

A network client may access server tools and operations with admin privileges; the exact consequences depend on the tools enabled and reachable CAD environment.

Mechanism

The default listener host is 0.0.0.0 and the authorization middleware assigns admin access when no API keys are configured.

AI rationale

Evidence

package.jsondist/atlisp-mcp.js

Network endpoints1

0.0.0.0

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The published CLI and main entrypoint both load dist/atlisp-mcp.js.
The server defaults to HTTP on 0.0.0.0 with an empty API key.
When no API keys are configured, the authorization middleware grants admin access to requests without credentials.
The HTTP server listens on the configured host, exposing this unauthenticated admin path beyond localhost by default.

Evidence against

Autostart installation is activated by an explicit --install-autostart command; package installation alone does not create that persistence.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.47 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

9 flagged

dist/atlisp-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.9.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1132}); L1133: import { spawn } from "child_process"; L1134: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1132

22923const baseCmd = getStartupCommand(); L22924: const psCmd = `powershell -WindowStyle Hidden -Command "${baseCmd}"`; L22925: try {

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22923

87const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L87

87Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L87

87Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L87

972try { L973: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L974: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L972

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L87

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 22016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

9 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1132}); L1133: import { spawn } from "child_process"; L1134: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1132

22923const baseCmd = getStartupCommand(); L22924: const psCmd = `powershell -WindowStyle Hidden -Command "${baseCmd}"`; L22925: try {

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22923

Findings

1 Critical5 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

MediumShips Native Binarydist/cad-rothelper.dll

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @atlisp/mcp@1.9.4.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.9.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 02:53:25.752Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.