registry / @atom8n/inspector / 0.17.28

@atom8n/inspector@0.17.28

Model Context Protocol inspector

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 2.04 MB of source, external domains: 10.1.1.22, drafts.csswg.org, example.com, gist.github.com, gist.githubusercontent.com, github.com, json-schema.org, modelcontextprotocol.io, opencode.ai, radix-ui.com, raw.githubusercontent.com, reactjs.org, stackoverflow.com, tools.ietf.org, www.w3.org

Source & flagged code

6 flagged

server/build/index.sync-conflict-20260328-010736-4BZRIAA.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2import cors from "cors";

3import { parseArgs } from "node:util";

4import { parse as shellParseArgs } from "shell-quote";

5import nodeFetch, { Headers as NodeHeaders } from "node-fetch";

6// Type-compatible wrappers for node-fetch to work with browser-style types

7const fetch = nodeFetch;

8const Headers = NodeHeaders;

9import { SSEClientTransport, SseError, } from "@modelcontextprotocol/sdk/client/sse.js";

10import { StdioClientTransport, getDefaultEnvironment, } from "@modelcontextprotocol/sdk/client/stdio.js";

11import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

12import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";

13import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";

14import { Client } from "@modelcontextprotocol/sdk/client/index.js";

15import express from "express";

16import path from "node:path";

17import os from "node:os";

18import { promises as fs } from "node:fs";

19import { exec } from "node:child_process";

20import { findActualExecutable } from "spawn-rx";

High

Child Process

Package source references child process execution.

server/build/index.sync-conflict-20260328-010736-4BZRIAA.jsView on unpkg · L18

21import mcpProxy from "./mcpProxy.js";

22import logger from "./logger.js";

23import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";

24const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277";

25const defaultEnvironment = {

26 ...getDefaultEnvironment(),

27 ...(process.env.MCP_ENV_VARS ? JSON.parse(process.env.MCP_ENV_VARS) : {}),

28};

29const { values } = parseArgs({

30 args: process.argv.slice(2),

31 options: {

32 env: { type: "string", default: "" },

33 args: { type: "string", default: "" },

34 command: { type: "string", default: "" },

35 transport: { type: "string", default: "" },

36 "server-url": { type: "string", default: "" },

37 },

38});

Lines 1485-1525javascript

1485 });

1486 });

1487 }

1488 catch (error) {

1489 logger.error(`Error opening config file (caught): ${error?.message || String(error)}`);

1490 res.status

client/dist/assets/index-Bq1jPbMY.jsView file

19500try { L19501: var makeValidate = new Function( L19502: "self",

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/dist/assets/index-Bq1jPbMY.jsView on unpkg · L19500

server/build/index.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2import cors from "cors";

3import { parseArgs } from "node:util";

4import nodeFetch, { Headers as NodeHeaders } from "node-fetch";

5// Type-compatible wrappers for node-fetch to work with browser-style types

Source & flagged code

6 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code