registry / @daileyos/mcp-server / 1.20.0

@daileyos/mcp-server@1.20.0

Dailey OS MCP server for Claude Code and AI assistants

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 83 file(s), 494 KB of source, external domains: docs.dailey.cloud, github.com, oldsite.com, os.dailey.cloud

Source & flagged code

2 flagged

tests/pack1-mcp-preflight.test.mjsView file

Lines 52-92javascript

52 // Drop the parent's credentials unless explicitly restored below.

53 PATH: process.env.PATH,

54 HOME: isolatedHome,

55 XDG_CONFIG_HOME: join(isolatedHome, '.config'),

56 NODE_PATH: process.env.NODE_PATH,

57 ...env,

58 };

60 let child;

61 if (tty) {

62 if (!unbufferAvailable()) {

63 resolve({ code: -1, stdout: '', stderr: 'unbuffer-not-available', skipped: true });

64 return;

65 }

66 // unbuffer allocates a pty on stdout (but NOT stdin). For `stdin.isTTY`,

67 // we use `script` if available — or we fall back to a node wrapper that

68 // forces process.stdin.isTTY = true before requiring the real binary.

69 // Simplest cross-platform: use a small wrapper file that stamps the TTY

70 // flag and then dynamically imports the real entry.

71 child = spawn(

72 'node',

73 ['-e', `process.stdin.isTTY = true; process.stdout.isTTY = true; await import(${JSON.stringify(BINARY)});`],

74 { env: cleanEnv, stdio: ['pipe', 'pipe', 'pipe'] },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/pack1-mcp-preflight.test.mjsView on unpkg · L72

75 );

76 } else {

77 child = spawn('node', [BINARY], { env: cleanEnv, stdio: ['pipe', 'pipe', 'pipe'] });

78 }

80 let stdout = '';

81 let stderr = '';

82 child.stdout.on('data', (c) => { stdout += c.toString(); });

83 child.stderr.on('data', (c) => { stderr += c.toString(); });

85 const timer = setTimeout(() => {

86 try { child.kill('SIGTERM'); } catch {}

87 }, waitMs);

89 child.on('close', (code) => {

90 clearTimeout(timer);

91 setImmediate(() => resolve({ code, stdout, stderr, killed: false }));

92 });

dist/api.jsView file

Lines 1-23javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3import { readFileSync } from 'node:fs';

4const API_URL = process.env.DAILEY_API_URL || 'https://os.dailey.cloud/api';

5const DAILEY_EMAIL

Source & flagged code

2 flagged · loading source

tests/pack1-mcp-preflight.test.mjsView file

72'node', L73: ['-e', `process.stdin.isTTY = true; process.stdout.isTTY = true; await import(${JSON.stringify(BINARY)});`], L74: { env: cleanEnv, stdio: ['pipe', 'pipe', 'pipe'] },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/pack1-mcp-preflight.test.mjsView on unpkg · L72

dist/api.jsView file

3import { readFileSync } from 'node:fs'; L4: const API_URL = process.env.DAILEY_API_URL || 'https://os.dailey.cloud/api'; L5: const DAILEY_EMAIL = process.env.DAILEY_EMAIL; ... L16: let dir; L17: if (process.platform === 'darwin') { L18: dir = join(homedir(), 'Library', 'Preferences', name); L19: } ... L25: } L26: const cfg = JSON.parse(readFileSync(join(dir, 'config.json'), 'utf8')); L27: const tok = typeof cfg?.token === 'string' ? cfg.token.trim() : ''; ... L65: // MCP-stdio invocation and emit a JSON-RPC-shaped error instead of just L66: // dying with a stderr line that Claude Code doesn't surface.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/api.jsView on unpkg · L3

Findings

1 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/api.js

MediumDynamic Requiretests/pack1-mcp-preflight.test.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

tests/pack1-mcp-preflight.test.mjsView file

Lines 52-92javascript

52 // Drop the parent's credentials unless explicitly restored below.

53 PATH: process.env.PATH,

54 HOME: isolatedHome,

55 XDG_CONFIG_HOME: join(isolatedHome, '.config'),

56 NODE_PATH: process.env.NODE_PATH,

57 ...env,

58 };

60 let child;

61 if (tty) {

62 if (!unbufferAvailable()) {

63 resolve({ code: -1, stdout: '', stderr: 'unbuffer-not-available', skipped: true });

64 return;

65 }

66 // unbuffer allocates a pty on stdout (but NOT stdin). For `stdin.isTTY`,

67 // we use `script` if available — or we fall back to a node wrapper that

68 // forces process.stdin.isTTY = true before requiring the real binary.

69 // Simplest cross-platform: use a small wrapper file that stamps the TTY

70 // flag and then dynamically imports the real entry.

71 child = spawn(

72 'node',

73 ['-e', `process.stdin.isTTY = true; process.stdout.isTTY = true; await import(${JSON.stringify(BINARY)});`],

74 { env: cleanEnv, stdio: ['pipe', 'pipe', 'pipe'] },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/pack1-mcp-preflight.test.mjsView on unpkg · L72

75 );

76 } else {

77 child = spawn('node', [BINARY], { env: cleanEnv, stdio: ['pipe', 'pipe', 'pipe'] });

78 }

80 let stdout = '';

81 let stderr = '';

82 child.stdout.on('data', (c) => { stdout += c.toString(); });

83 child.stderr.on('data', (c) => { stderr += c.toString(); });

85 const timer = setTimeout(() => {

86 try { child.kill('SIGTERM'); } catch {}

87 }, waitMs);

89 child.on('close', (code) => {

90 clearTimeout(timer);

91 setImmediate(() => resolve({ code, stdout, stderr, killed: false }));

92 });

dist/api.jsView file

Lines 1-23javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3import { readFileSync } from 'node:fs';

4const API_URL = process.env.DAILEY_API_URL || 'https://os.dailey.cloud/api';

5const DAILEY_EMAIL