registry / @brandsystem/mcp / 0.9.6

@brandsystem/mcp@0.9.6

Author a portable .brand runtime — the governance layer that travels with your brand. Extract identity from websites, Figma, and PDFs; compile tokens, anti-patterns, and voice rules into a single .brand/ directory; connect directly to MCP clients like Cla

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 107 file(s), 1.01 MB of source, external domains: acme.com, api.firecrawl.dev, basecamp.com, brandcode.studio, brandsystem.app, logo.clearbit.com, mcp.brandcode.studio, www.brandcode.studio, www.google.com, yourbrand.com

Source & flagged code

1 flagged

dist/index-http.jsView file

Lines 1-31javascript

1/**

2 * Node HTTP entry for the hosted Brandcode MCP.

3 *

4 * Reads config from environment (staging/production, UCS base URL, service

5 * token) and binds the router to a Node http.Server. Used by:

6 * - `bin/brandcode-mcp.mjs` for local dev

7 * - CI smoke harness

8 *

9 * Vercel deployments use `api/[slug].ts` instead — it calls the

10 * same router directly, no Node server adapter required.

11 */

12import http from "node:http";

13import { Readable } from "node:stream";

14import { BRANDCODE_MCP_SERVICE_TOKEN_ENV, readBrandcodeMcpServiceToken, } from "./hosted/env.js";

15import { handleHostedRequest } from "./hosted/router.js";

16function readEnv() {

17 const environment = process.env.BRANDCODE_MCP_ENV === "production" ? "production" : "staging";

18 const ucsServiceToken = readBrandcodeMcpServiceToken();

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index-http.jsView on unpkg · L11

19 if (!ucsServiceToken) {

20 throw new Error(`${BRANDCODE_MCP_SERVICE_TOKEN_ENV} is required for hosted MCP to call UCS`);

21 }

22 return {

23 environment,

24 ucsBaseUrl: process.env.UCS_API_BASE_URL ?? "https://www.brandcode.studio",

25 ucsServiceToken,

26 };

27}

28async function nodeToWebRequest(req) {

29 const host = req.headers.host ?? "localhost";

30 const protocol = "http";

31 const url = new URL(req.url ?? "/", `${protocol}://${host}`);

Source & flagged code

1 flagged · loading source

dist/index-http.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code