registry / @daileyos/mcp-server / 1.20.1

@daileyos/mcp-server@1.20.1

Dailey OS MCP server for Claude Code and AI assistants

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 91 file(s), 575 KB of source, external domains: core.dailey.cloud, docs.dailey.cloud, github.com, oldsite.com, os.dailey.cloud, yourapp.dailey.cloud

Source & flagged code

3 flagged

tests/dailey-images.test.mjsView file

Lines 106-146javascript

106 assert.ok(!genRequired.includes('n'), 'n must be optional');

107 // model is an enum with the two tiers

108 const modelEnum = gen.inputSchema.properties.model.enum;

109 assert.deepEqual(modelEnum, ['dailey-fast', 'dailey-pro'], 'model enum must be the two tiers');

110 } finally {

111 child.kill();

112 }

113 });

114});

115

116// ── Layer 2: in-process registration checks ────────────────────────────────

117

118describe('dailey images tools — registration', { concurrency: false }, () => {

119 test('registers all three tools with the right shapes', async () => {

120 const registrations = [];

121 const stubServer = {

122 tool(name, description, schema, handler) {

123 registrations.push({ name, description, schema, handler });

124 },

125 };

126

127 const mod = await import(join(__dirname, '..', 'dist', 'tools', 'dailey-images.js'));

128 mod.registerDaileyImagesTools(stubServer);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/dailey-images.test.mjsView on unpkg · L126

129

130 const byName = Object.fromEntries(registrations.map((r) => [r.name, r]));

131

132 const gen = byName['dailey_images_generate'];

133 assert.ok(gen, 'dailey_images_generate must be registered');

134 assert.ok(typeof gen.handler === 'function', 'generate handler must be a function');

135 assert.ok(gen.schema?.project && gen.schema?.prompt, 'generate must have project + prompt');

136 // metered cost is called out in the description

137 assert.match(gen.description, /2¢/, 'generate description must mention 2¢ (fast)');

138 assert.match(gen.description, /10¢/, 'generate description must mention 10¢ (pro)');

139 assert.match(gen.description, /prepaid credits/i, 'generate description must mention prepaid credits');

140 // prompt required, model optional

141 const promptOptional = gen.schema.prompt?._def?.typeName === 'ZodOptional'

142 || (typeof gen.schema.prompt?.isOptional === 'function' && gen.schema.prompt.isOptional());

143 assert.ok(!promptOptional, 'prompt must NOT be optional');

144 const modelOptional = gen.schema.model?._def?.typeName === 'ZodOptional'

145 || (typeof gen.schema.model?.isOptional === 'function' && gen.schema.model.isOptional());

146 assert.ok(modelOptional, 'model must be optional');

dist/api.jsView file

Lines 1-23javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3import { readFileSync } from 'node:fs';

4const API_URL = process.env.DAILEY_API_URL || 'https://os.dailey.cloud/api';

5const DAILEY_EMAIL

tests/environments.test.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @daileyos/mcp-server@1.20.0 matchedIdentity = npm:QGRhaWxleW9zL21jcC1zZXJ2ZXI:1.20.0 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tests/environments.test.mjsView on unpkg

Source & flagged code

3 flagged · loading source

tests/dailey-images.test.mjsView file

126L127: const mod = await import(join(__dirname, '..', 'dist', 'tools', 'dailey-images.js')); L128: mod.registerDaileyImagesTools(stubServer);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/dailey-images.test.mjsView on unpkg · L126

dist/api.jsView file

3import { readFileSync } from 'node:fs'; L4: const API_URL = process.env.DAILEY_API_URL || 'https://os.dailey.cloud/api'; L5: const DAILEY_EMAIL = process.env.DAILEY_EMAIL; ... L16: let dir; L17: if (process.platform === 'darwin') { L18: dir = join(homedir(), 'Library', 'Preferences', name); L19: } ... L25: } L26: const cfg = JSON.parse(readFileSync(join(dir, 'config.json'), 'utf8')); L27: const tok = typeof cfg?.token === 'string' ? cfg.token.trim() : ''; ... L65: // MCP-stdio invocation and emit a JSON-RPC-shaped error instead of just L66: // dying with a stderr line that Claude Code doesn't surface.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/api.jsView on unpkg · L3

tests/environments.test.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tests/environments.test.mjsView on unpkg

Findings

2 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/api.js

HighPrevious Version Dangerous Deltatests/environments.test.mjs

MediumDynamic Requiretests/dailey-images.test.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

tests/dailey-images.test.mjsView file

Lines 106-146javascript

106 assert.ok(!genRequired.includes('n'), 'n must be optional');

107 // model is an enum with the two tiers

108 const modelEnum = gen.inputSchema.properties.model.enum;

109 assert.deepEqual(modelEnum, ['dailey-fast', 'dailey-pro'], 'model enum must be the two tiers');

110 } finally {

111 child.kill();

112 }

113 });

114});

115

116// ── Layer 2: in-process registration checks ────────────────────────────────

117

118describe('dailey images tools — registration', { concurrency: false }, () => {

119 test('registers all three tools with the right shapes', async () => {

120 const registrations = [];

121 const stubServer = {

122 tool(name, description, schema, handler) {

123 registrations.push({ name, description, schema, handler });

124 },

125 };

126

127 const mod = await import(join(__dirname, '..', 'dist', 'tools', 'dailey-images.js'));

128 mod.registerDaileyImagesTools(stubServer);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/dailey-images.test.mjsView on unpkg · L126

129

130 const byName = Object.fromEntries(registrations.map((r) => [r.name, r]));

131

132 const gen = byName['dailey_images_generate'];

133 assert.ok(gen, 'dailey_images_generate must be registered');

134 assert.ok(typeof gen.handler === 'function', 'generate handler must be a function');

135 assert.ok(gen.schema?.project && gen.schema?.prompt, 'generate must have project + prompt');

136 // metered cost is called out in the description

137 assert.match(gen.description, /2¢/, 'generate description must mention 2¢ (fast)');

138 assert.match(gen.description, /10¢/, 'generate description must mention 10¢ (pro)');

139 assert.match(gen.description, /prepaid credits/i, 'generate description must mention prepaid credits');

140 // prompt required, model optional

141 const promptOptional = gen.schema.prompt?._def?.typeName === 'ZodOptional'

142 || (typeof gen.schema.prompt?.isOptional === 'function' && gen.schema.prompt.isOptional());

143 assert.ok(!promptOptional, 'prompt must NOT be optional');

144 const modelOptional = gen.schema.model?._def?.typeName === 'ZodOptional'

145 || (typeof gen.schema.model?.isOptional === 'function' && gen.schema.model.isOptional());

146 assert.ok(modelOptional, 'model must be optional');

dist/api.jsView file

Lines 1-23javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3import { readFileSync } from 'node:fs';

4const API_URL = process.env.DAILEY_API_URL || 'https://os.dailey.cloud/api';

5const DAILEY_EMAIL

tests/environments.test.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tests/environments.test.mjsView on unpkg