registry / @calltelemetry/ct-lab-mcp / 0.8.24

@calltelemetry/ct-lab-mcp@0.8.24

⚠ Under review

Expanded Model Context Protocol (MCP) server for Call Telemetry lab, fleet, and appliance management across Proxmox VE and VMware ESXi.

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 987 KB of source, external domains: 127.0.0.1, 192.168.123.176, 192.168.123.177, 192.168.123.178, 192.168.124, 192.168.124.120, 192.168.124.229, api.doppler.com, schemas.cisco.com, schemas.xmlsoap.org, www.cisco.com

Source & flagged code

10 flagged

dist/src/tools/license-tools.jsView file

Lines 67-109javascript

67 const parsed = ApplyLicenseInputSchema.safeParse(args);

68 if (!parsed.success) {

69 const issues = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");

70 return createToolErrorResult(ProxmoxErrorCode.VALIDATION_ERROR, issues);

71 }

72 const { targetIp, tier, days, orgId, token, email, password, timeoutMs } = parsed.data;

73 // Normalize target URL

74 let baseUrl = targetIp.trim();

75 if (!baseUrl.startsWith("http://") && !baseUrl.startsWith("https://")) {

76 baseUrl = `https://${baseUrl}`;

77 }

78 baseUrl = baseUrl.replace(/\/+$/, "");

79 logger.info(`Applying ${tier} license (${days} days) to org ${orgId} on ${baseUrl}...`);

80 try {

81 // 1. Authenticate to obtain session token

82 // Try provided credentials, or fallback candidate list

83 const candidateCredentials = [

84 ...(email && password ? [{ email, password }] : []),

85 { email: process.env.CT_TEST_USER_EMAIL || "demo@calltelemetry.com", password: process.env.CT_TEST_USER_PASSWORD || "demo" },

86 { email: process.env.CT_ADMIN_EMAIL || "test@calltelemetry.com", password: process.env.CT_ADMIN_PASSWORD || "Password123!" },

87 { email: "admin@calltelemetry.com", password: "Password123!" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/tools/license-tools.jsView on unpkg · L87

88 { email: "admin@calltelemetry.com", password: "calltelemetry" },

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L88

89 { email: "test@calltelemetry.com", password: "calltelemetry" }

Medium

Secret Pattern

Hardcoded password in dist/src/tools/license-tools.js

dist/src/tools/license-tools.jsView on unpkg · L89

90 ];

91 let authHeaders = { "Content-Type": "application/json" };

92 let authenticated = false;

93 let lastAuthError = "";

94 const sessionUrl = `${baseUrl}/api/session`;

95 for (const cred of candidateCredentials) {

96 try {

97 const sessionRes = await fetch(sessionUrl, {

98 method: "POST",

99 headers: { "Content-Type": "application/json" },

100 body: JSON.stringify({ user: { email: cred.email, password: cred.password } }),

101 dispatcher: insecureAgent,

102 signal: AbortSignal.timeout(Math.min(timeoutMs, 5000))

103 });

104 if (sessionRes.status === 200 || sessionRes.ok) {

105 const sessionData = (await sessionRes.json().catch(() => ({})));

106 const accessToken = sessionData?.access_token || sessionData?.data?.access_token || sessionData?.token;

107 const setCookie = sessionRes.headers.get("set-cookie") || "";

108 const sessionCookie = setCookie.split(";")[0];

109 if (sessionCookie) {

dist/bin/ct-lab-mcp.jsView file

Lines 176-216javascript

176 console.log("[ct-lab-mcp] Stopping purge daemon...");

177 controller.stop();

178 resolve(0);

179 };

180 process.once("SIGINT", handleSig);

181 process.

dist/src/tools/server-management.jsView file

Lines 97-137javascript

97 lines.push("| Target | Version / Revision | Status |");

98 lines.push("|---|---|---|");

99 lines.push(`| **Installed Runtime** | \`v${CURRENT_VERSION}\` | \`CURRENT\` |`

dist/src/tools/script-runner.jsView file

•matchType = normalized_sha256 matchedPackage = @calltelemetry/ct-lab-mcp@0.7.1 matchedPath = dist/src/tools/script-runner.js matchedIdentity = npm:[redacted]:0.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/tools/script-runner.jsView on unpkg

dist/src/tools/cube-canonical.jsView file

•matchType = normalized_sha256 matchedPackage = @calltelemetry/ct-lab-mcp@0.7.1 matchedPath = dist/src/tools/cube-canonical.js matchedIdentity = npm:[redacted]:0.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/tools/cube-canonical.jsView on unpkg

dist/src/credentials/resolver.jsView file

Lines 559-612javascript

559 baseUrl: isLab ? "https://192.168.123.177:8006/api2/json" : "https://192.168.123.178:8006/api2/json",

560 nodeName: isLab ? "proxmox" : "proxmox-mini",

561 auth

Source & flagged code

10 flagged · loading source

dist/src/tools/license-tools.jsView file

@calltelemetry/ct-lab-mcp@0.8.24

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code