registry / @finchagentic/mcp / 4.5.0
@finchagentic/mcp@4.5.0
The runtime layer for Agentic AI. Persistent memory, autonomous agents, and workflows that survive every session.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/tools/automation.jsView file
6exports.handleAutomationTool = handleAutomationTool;
L7: const zod_1 = require("zod");
L8: const convex_js_1 = require("../convex.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/tools/automation.jsView on unpkg · L6dist/local-vault.jsView file
67// vault handlers already catch and format that).
L68: const VAULT_DIR = path.join(os.homedir(), ".finch", "vault");
L69: // Local vault is enabled purely by config - it needs no server, just the
...
L88: const raw = fs.readFileSync(indexPath(cfg), "utf8");
L89: const parsed = JSON.parse(raw);
L90: return { entries: parsed.entries ?? {}, links: parsed.links ?? [] };
...
L174: agentId: input.agentId, tags, pinned: false, currentVersion: 1,
L175: createdAt: ts, updatedAt: ts, metadata: input.metadata,
L176: versions: [{ version: 1, commitMsg: input.commitMsg, agentId: input.agentId, size: Buffer.byteLength(input.content), createdAt: ts }],
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/local-vault.jsView on unpkg · L67Findings
4 High4 Medium6 Low
HighCredential Exfiltrationdist/agent-loop.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/agent-loop.js
MediumDynamic Requiredist/tools/automation.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/local-vault.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @finchagentic/mcp@4.5.0.
See all versions of @finchagentic/mcp for other recorded verdicts.
- Review the evidence and your use of @finchagentic/mcp@4.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.