registry / @brandsystem/mcp / 0.13.3

@brandsystem/mcp@0.13.3

⚠ Under review

Use existing brand guidelines with AI. This MCP server turns websites, PDFs, and Figma libraries into a portable .brand runtime with design tokens, voice rules, provenance, and compliance checks.

Static Scan Results

scanned 45m ago · by rust-scanner

Static analysis flagged 8 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 114 file(s), 1.08 MB of source, external domains: acme.com, api.firecrawl.dev, basecamp.com, brandcode.studio, brandsystem.app, logo.clearbit.com, mcp.brandcode.studio, www.brandcode.studio, www.google.com, yourbrand.com

Source & flagged code

2 flagged

dist/index-http.jsView file

Lines 1-31javascript

1/**

2 * Node HTTP entry for the hosted Brandcode MCP.

3 *

4 * Reads config from environment (staging/production, UCS base URL, service

5 * token) and binds the router to a Node http.Server. Used by:

6 * - `bin/brandcode-mcp.mjs` for local dev

7 * - CI smoke harness

8 *

9 * Vercel deployments use `api/[slug].ts` instead — it calls the

10 * same router directly, no Node server adapter required.

11 */

12import http from "node:http";

13import { Readable } from "node:stream";

14import { BRANDCODE_MCP_SERVICE_TOKEN_ENV, readBrandcodeMcpServiceToken, } from "./hosted/env.js";

15import { handleHostedRequest } from "./hosted/router.js";

16function readEnv() {

17 const environment = process.env.BRANDCODE_MCP_ENV === "production" ? "production" : "staging";

18 const ucsServiceToken = readBrandcodeMcpServiceToken();

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index-http.jsView on unpkg · L11

19 if (!ucsServiceToken) {

20 throw new Error(`${BRANDCODE_MCP_SERVICE_TOKEN_ENV} is required for hosted MCP to call UCS`);

21 }

22 return {

23 environment,

24 ucsBaseUrl: process.env.UCS_API_BASE_URL ?? "https://www.brandcode.studio",

25 ucsServiceToken,

26 };

27}

28async function nodeToWebRequest(req) {

29 const host = req.headers.host ?? "localhost";

30 const protocol = "http";

31 const url = new URL(req.url ?? "/", `${protocol}://${host}`);

dist/tools/brand-feedback.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @brandsystem/mcp@0.9.6 matchedIdentity = npm:QGJyYW5kc3lzdGVtL21jcA:0.9.6 similarity = 0.505 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools/brand-feedback.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index-http.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code