@atlisp/mcp@1.9.8

⚠ Under review

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The inspected package source does not establish malicious behavior, and autostart setup is explicitly invoked. The imported edge-js runtime dependency remains unresolved, so source review cannot support a clean verdict.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Importing or running the package entrypoint loads edge-js; autostart installation requires an explicit command-line option.

Impact

The uninspected dependency leaves runtime behavior unresolved; the health report discloses machine-identifying information to the package service.

Mechanism

The entrypoint imports a native integration dependency whose behavior was not resolved. The package also sends periodic health data, including a hostname-based client identifier, to its service.

AI rationale

Evidence

package.jsondist/atlisp-mcp.js

Network endpoints1

atlisp.cn/api/mcp/health

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

The published entrypoint imports edge-js, and the manifest declares it as a runtime dependency; its source was not available for this review.
The runtime also installs a health reporter that sends a client identifier, using the machine hostname when no client ID is configured, with health data to the package service.

Evidence against

Autostart setup is behind an explicit --install-autostart command-line option.
The manifest's prepublishOnly hook runs the build.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 1.54 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

9 flagged

dist/atlisp-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.9.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2 similarity = 0.881 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1133}); L1134: import { spawn } from "child_process"; L1135: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1133

23675const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L23676: return `powershell -WindowStyle Hidden -Command "${base}"`; L23677: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L23675

87const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L87

87Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L87

87Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L87

973try { L974: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L975: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L973

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L87

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 27136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

9 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1133}); L1134: import { spawn } from "child_process"; L1135: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1133

23675const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L23676: return `powershell -WindowStyle Hidden -Command "${base}"`; L23677: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L23675

Findings

1 Critical5 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

MediumShips Native Binarydist/cad-rothelper.dll

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @atlisp/mcp@1.9.8.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.9.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 02:54:10.394Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.