registry / @daileyos/mcp-server / 1.21.0

@daileyos/mcp-server@1.21.0

Dailey OS MCP server for Claude Code and AI assistants

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 101 file(s), 672 KB of source, external domains: core.dailey.cloud, docs.dailey.cloud, github.com, oldsite.com, os.dailey.cloud, registry.npmjs.org, yourapp.dailey.cloud

Source & flagged code

2 flagged

dist/version.jsView file

Lines 1-35javascript

1/**

2 * Version identity + staleness self-check.

3 *

4 * WHY (2026-07-13 dogfood incident): sessions silently ran a months-old MCP

5 * (global-install shadowing + stale npx cache), so the agent was missing ~35

6 * tools and told the customer the platform had no AI. Staleness must never be

7 * silent again:

8 * - OWN_VERSION is read from package.json (the server previously hardcoded a

9 * stale string) and sent on every API request as X-Dailey-Client-Version,

10 * so the platform can see exactly which versions are live in the field.

11 * - checkForNewerVersion() asks the npm registry (fail-open, hard timeout)

12 * whether this copy is behind; the caller surfaces the notice to the AGENT

13 * via server instructions, so the agent itself tells the user to update.

14 */

15import { createRequire } from 'node:module';

16const require = createRequire(import.meta.url);

17export const OWN_VERSION = (() => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/version.jsView on unpkg · L15

18 try {

19 return require('../package.json').version ?? '0.0.0';

20 }

21 catch {

22 return '0.0.0';

23 }

24})();

25/** Numeric semver compare (a<b → -1). Non-numeric parts compare as 0. */

26function cmpSemver(a, b) {

27 const pa = a.split('.').map((x) => parseInt(x, 10) || 0);

28 const pb = b.split('.').map((x) => parseInt(x, 10) || 0);

29 for (let i = 0; i < 3; i++) {

30 if ((pa[i] ?? 0) < (pb[i] ?? 0))

31 return -1;

32 if ((pa[i] ?? 0) > (pb[i] ?? 0))

33 return 1;

34 }

35 return 0;

dist/api.jsView file

Lines 1-24javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3import { readFileSync } from 'node:fs';

4import { OWN_VERSION } from './version.js';

5const API_URL = process.env.DAILEY_API_URL ||

Source & flagged code

2 flagged · loading source

dist/version.jsView file

15import { createRequire } from 'node:module'; L16: const require = createRequire(import.meta.url); L17: export const OWN_VERSION = (() => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/version.jsView on unpkg · L15

dist/api.jsView file

4import { OWN_VERSION } from './version.js'; L5: const API_URL = process.env.DAILEY_API_URL || 'https://os.dailey.cloud/api'; L6: const DAILEY_EMAIL = process.env.DAILEY_EMAIL; ... L17: let dir; L18: if (process.platform === 'darwin') { L19: dir = join(homedir(), 'Library', 'Preferences', name); L20: } ... L26: } L27: const cfg = JSON.parse(readFileSync(join(dir, 'config.json'), 'utf8')); L28: const tok = typeof cfg?.token === 'string' ? cfg.token.trim() : ''; ... L66: // MCP-stdio invocation and emit a JSON-RPC-shaped error instead of just L67: // dying with a stderr line that Claude Code doesn't surface.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/api.jsView on unpkg · L4

Findings

1 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/api.js

MediumDynamic Requiredist/version.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/version.jsView file

Lines 1-35javascript

1/**

2 * Version identity + staleness self-check.

3 *

4 * WHY (2026-07-13 dogfood incident): sessions silently ran a months-old MCP

5 * (global-install shadowing + stale npx cache), so the agent was missing ~35

6 * tools and told the customer the platform had no AI. Staleness must never be

7 * silent again:

8 * - OWN_VERSION is read from package.json (the server previously hardcoded a

9 * stale string) and sent on every API request as X-Dailey-Client-Version,

10 * so the platform can see exactly which versions are live in the field.

11 * - checkForNewerVersion() asks the npm registry (fail-open, hard timeout)

12 * whether this copy is behind; the caller surfaces the notice to the AGENT

13 * via server instructions, so the agent itself tells the user to update.

14 */

15import { createRequire } from 'node:module';

16const require = createRequire(import.meta.url);

17export const OWN_VERSION = (() => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/version.jsView on unpkg · L15

18 try {

19 return require('../package.json').version ?? '0.0.0';

20 }

21 catch {

22 return '0.0.0';

23 }

24})();

25/** Numeric semver compare (a<b → -1). Non-numeric parts compare as 0. */

26function cmpSemver(a, b) {

27 const pa = a.split('.').map((x) => parseInt(x, 10) || 0);

28 const pb = b.split('.').map((x) => parseInt(x, 10) || 0);

29 for (let i = 0; i < 3; i++) {

30 if ((pa[i] ?? 0) < (pb[i] ?? 0))

31 return -1;

32 if ((pa[i] ?? 0) > (pb[i] ?? 0))

33 return 1;

34 }

35 return 0;

dist/api.jsView file

Lines 1-24javascript

1import { homedir } from 'node:os';

2import { join } from 'node:path';

3import { readFileSync } from 'node:fs';

4import { OWN_VERSION } from './version.js';

5const API_URL = process.env.DAILEY_API_URL ||