registry / @dypai-ai/mcp / 1.7.5

@dypai-ai/mcp@1.7.5

DYPAI MCP Server — AI agent toolkit for building and deploying full-stack apps

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 770 KB of source, external domains: dyapi.dypai.dev, github.com, hooks.example.com, mcp.dypai.dev, registry.npmjs.org

Source & flagged code

2 flagged

src/tools/scaffold.jsView file

Lines 112-152javascript

112 ".idea/",

113 "",

114 ].join("\n") })

115

116 // SDK client helper (lib/dypai.ts)

117 files.push({ path: "src/lib/dypai.ts", content: `import { createClient } from "@dypai-ai/client-sdk";\n\nexport const dypai = createClient(import.meta.env.VITE_DYPAI_URL);\n` })

118

119 // Write files to disk. Use `dirname()` rather than slicing on "/" — on

120 // Windows the path separator is "\" so the slice approach produced a

121 // garbage parent dir and the writeFileSync below failed with ENOENT.

122 let created = 0

123 for (const file of files) {

124 const fullPath = join(directory, file.path)

125 mkdirSync(dirname(fullPath), { recursive: true })

126 writeFileSync(fullPath, file.content)

127 created++

128 }

129

130 // Try to run npm install (best-effort, works if Node is available)

131 let installed = false

132 try {

133 const { execSync } = await import("child_process")

134 execSync("npm install", { cwd: directory, stdio: "pipe", timeout: 60000 })

High

Child Process

Package source references child process execution.

src/tools/scaffold.jsView on unpkg · L132

135 installed = true

136 } catch {}

137

138 return {

139 success: true,

140 directory,

141 files_created: created,

142 dependencies_installed: installed,

143 template: template || "template-blank-mixed",

144 engine_url: engineUrl,

145 sdk_client: "src/lib/dypai.ts",

146 // Critical: dypai_pull without an absolute out_dir can land in $HOME

147 // when the MCP process cwd isn't the workspace. Tell the agent exactly

148 // what to pass next so the backend materializes INSIDE this project.

149 next_step: {

150 action: "materialize_backend",

151 tool: "dypai_pull",

152 args: {

src/auto-update.jsView file

Lines 1-24javascript

1/**

2 * Self-update for @dypai-ai/mcp.

3 *

4 * On every startup, checks the npm registry for a newer version. If found, performs

5 * the appropriate update (clear npx cache or `npm install -g`) and exits with

6 * code 0 so the host (Cursor / Claude / Trae / VSCode) re-spawns the process

7 * with the freshly installed version.

8 *

9 * Disable with: DYPAI_NO_AUTOUPDATE=1

10 */

12import { readFileSync, writeFileSync, existsSync, rmSync, readdirSync, statSync }

Source & flagged code

2 flagged · loading source

src/tools/scaffold.jsView file

132try { L133: const { execSync } = await import("child_process") L134: execSync("npm install", { cwd: directory, stdio: "pipe", timeout: 60000 })

High

Child Process

Package source references child process execution.

src/tools/scaffold.jsView on unpkg · L132

src/auto-update.jsView file

4* On every startup, checks the npm registry for a newer version. If found, performs L5: * the appropriate update (clear npx cache or `npm install -g`) and exits with L6: * code 0 so the host (Cursor / Claude / Trae / VSCode) re-spawns the process ... L15: import { homedir, tmpdir } from "node:os"; L16: import { execSync } from "node:child_process"; L17:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/auto-update.jsView on unpkg · L4

Findings

3 High3 Medium5 Low

HighChild Processsrc/tools/scaffold.js

HighShell

HighRuntime Package Installsrc/auto-update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/tools/scaffold.jsView file

Lines 112-152javascript

112 ".idea/",

113 "",

114 ].join("\n") })

115

116 // SDK client helper (lib/dypai.ts)

117 files.push({ path: "src/lib/dypai.ts", content: `import { createClient } from "@dypai-ai/client-sdk";\n\nexport const dypai = createClient(import.meta.env.VITE_DYPAI_URL);\n` })

118

119 // Write files to disk. Use `dirname()` rather than slicing on "/" — on

120 // Windows the path separator is "\" so the slice approach produced a

121 // garbage parent dir and the writeFileSync below failed with ENOENT.

122 let created = 0

123 for (const file of files) {

124 const fullPath = join(directory, file.path)

125 mkdirSync(dirname(fullPath), { recursive: true })

126 writeFileSync(fullPath, file.content)

127 created++

128 }

129

130 // Try to run npm install (best-effort, works if Node is available)

131 let installed = false

132 try {

133 const { execSync } = await import("child_process")

134 execSync("npm install", { cwd: directory, stdio: "pipe", timeout: 60000 })

High

Child Process

Package source references child process execution.

src/tools/scaffold.jsView on unpkg · L132

135 installed = true

136 } catch {}

137

138 return {

139 success: true,

140 directory,

141 files_created: created,

142 dependencies_installed: installed,

143 template: template || "template-blank-mixed",

144 engine_url: engineUrl,

145 sdk_client: "src/lib/dypai.ts",

146 // Critical: dypai_pull without an absolute out_dir can land in $HOME

147 // when the MCP process cwd isn't the workspace. Tell the agent exactly

148 // what to pass next so the backend materializes INSIDE this project.

149 next_step: {

150 action: "materialize_backend",

151 tool: "dypai_pull",

152 args: {

src/auto-update.jsView file

Lines 1-24javascript

1/**

2 * Self-update for @dypai-ai/mcp.

3 *

4 * On every startup, checks the npm registry for a newer version. If found, performs

5 * the appropriate update (clear npx cache or `npm install -g`) and exits with

6 * code 0 so the host (Cursor / Claude / Trae / VSCode) re-spawns the process

7 * with the freshly installed version.

8 *

9 * Disable with: DYPAI_NO_AUTOUPDATE=1

10 */

12import { readFileSync, writeFileSync, existsSync, rmSync, readdirSync, statSync }