@atlisp/mcp@1.9.6

⚠ Under review

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The inspected source does not establish malicious behavior, and the flagged startup persistence requires an explicit command-line option. The unresolved selected `edge-js` dependency prevents a clean verdict under the review policy.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Import or use of the CAD helper that imports `edge-js`.

Impact

The dependency's behavior and impact remain unknown.

Mechanism

The package declares and imports the dependency, but its source was unavailable for inspection.

AI rationale

Evidence

package.jsondist/atlisp-mcp.js

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares `edge-js` as a runtime dependency, and the bundled CAD helper imports it; its selected source snapshot was unresolved in the supplied dependency inspection.
The bundle registers startup persistence only through the explicit `--install-autostart` command-line option.

Evidence against

The manifest's `prepublishOnly` hook runs the build, and the package has no install lifecycle hook.
The startup registration command is explicitly named and has a corresponding uninstall command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.47 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

9 flagged

dist/atlisp-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.9.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1133}); L1134: import { spawn } from "child_process"; L1135: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1133

22906const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L22907: return `powershell -WindowStyle Hidden -Command "${base}"`; L22908: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22906

87const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L87

87Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L87

87Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L87

973try { L974: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L975: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L973

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L87

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 22016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

9 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1133}); L1134: import { spawn } from "child_process"; L1135: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1133

22906const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L22907: return `powershell -WindowStyle Hidden -Command "${base}"`; L22908: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22906

Findings

1 Critical5 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

MediumShips Native Binarydist/cad-rothelper.dll

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @atlisp/mcp@1.9.6.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.9.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 02:53:40.113Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.