@constellationdev/mcp@1.2.10
Codebase Understanding for AI Coding Agents
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe active telemetry path exposes a service credential to an unrestricted configurable destination, warranting a warning under the credential-forwarding policy. The inspected execution and lifecycle behavior does not establish malware or justify blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
A successful code query makes API calls while usage tracking is enabled and USAGE_ENDPOINT_URL selects another destination.
Impact
The configured telemetry recipient can receive a credential intended for Constellation.
Mechanism
The telemetry sender reuses the Constellation access key in the authorization header of its POST request.
AI rationale
The active telemetry path exposes a service credential to an unrestricted configurable destination, warranting a warning under the credential-forwarding policy. The inspected execution and lifecycle behavior does not establish malware or justify blocking publication.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The active entrypoint reads the Constellation access key from the environment.
- Usage telemetry accepts USAGE_ENDPOINT_URL without restricting its destination.
- Telemetry sends the access key as bearer authentication to the selected endpoint.
- Successful code queries with API invocations activate telemetry using the existing access key.
- Usage tracking defaults to enabled and supports environment-based disabling.
Evidence against
- No package-controlled unrelated recipient or covert credential harvesting was established.
- Child process execution runs the bundled sandbox worker for caller-supplied queries.
- The manifest has a Husky prepare hook, no install hooks, and no runtime self-dependency.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
4 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: import {McpServer,ResourceTemplate}from'@[redacted].js';import {StdioServerTransport}from'@[redacted].js';import {promises,readF...
L3:
High
1#!/usr/bin/env node
L2: import {McpServer,ResourceTemplate}from'@[redacted].js';import {StdioServerTransport}from'@[redacted].js';import {promises,readF...
L3:
...
L11:
L12: For more information, visit: ${T.root}`;return {config:this.applyEnvironmentOverrides(i),gitRoot:e,loadedAt:Date.now(),configLoaded:false,initializationError:a}}}applyEnvironmentOv...
L13:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11Cross-file remote execution chain: dist/index.js spawns dist/sandbox-worker.js; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: import {McpServer,ResourceTemplate}from'@[redacted].js';import {StdioServerTransport}from'@[redacted].js';import {promises,readF...
L3:
...
L11:
L12: For more information, visit: ${T.root}`;return {config:this.applyEnvironmentOverrides(i),gitRoot:e,loadedAt:Date.now(),configLoaded:false,initializationError:a}}}applyEnvironmentOv...
L13:
...
L131: - Avoid deep \`offset\` paging \u2014 large offsets re-scan earlier rows and get progressively slower until they time out. For \`searchSymbols\`, narrow with \`filterByKind\`, \`is...
L132: ${c}`)}return await i.json()}catch(i){throw i instanceof v||i instanceof R||i instanceof j
Findings
3 High3 Medium6 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumUnsafe Vm Contextdist/sandbox-worker.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @constellationdev/mcp@1.2.10.
See all versions of @constellationdev/mcp for other recorded verdicts.
- Review the evidence and your use of @constellationdev/mcp@1.2.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.