registry / @constellationdev/mcp / 1.2.8
@constellationdev/mcp@1.2.8
Codebase Understanding for AI Coding Agents
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
4 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: import {McpServer,ResourceTemplate}from'@[redacted].js';import {StdioServerTransport}from'@[redacted].js';import {promises,readF...
L3:
High
1#!/usr/bin/env node
L2: import {McpServer,ResourceTemplate}from'@[redacted].js';import {StdioServerTransport}from'@[redacted].js';import {promises,readF...
L3:
...
L11:
L12: For more information, visit: ${T.root}`;return {config:this.applyEnvironmentOverrides(i),gitRoot:e,loadedAt:Date.now(),configLoaded:false,initializationError:a}}}applyEnvironmentOv...
L13:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11Cross-file remote execution chain: dist/index.js spawns dist/sandbox-worker.js; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: import {McpServer,ResourceTemplate}from'@[redacted].js';import {StdioServerTransport}from'@[redacted].js';import {promises,readF...
L3:
...
L11:
L12: For more information, visit: ${T.root}`;return {config:this.applyEnvironmentOverrides(i),gitRoot:e,loadedAt:Date.now(),configLoaded:false,initializationError:a}}}applyEnvironmentOv...
L13:
...
L131: - Avoid deep \`offset\` paging \u2014 large offsets re-scan earlier rows and get progressively slower until they time out. For \`searchSymbols\`, narrow with \`filterByKind\`, \`is...
L132: ${c}`)}return await i.json()}catch(i){throw i instanceof v||i instanceof R||i instanceof j
Findings
3 High3 Medium6 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumUnsafe Vm Contextdist/sandbox-worker.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @constellationdev/mcp@1.2.8.
See all versions of @constellationdev/mcp for other recorded verdicts.
- Review the evidence and your use of @constellationdev/mcp@1.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.