registry / @firfi/huly-mcp / 0.55.4
@firfi/huly-mcp@0.55.4
⚠ Under reviewHuly MCP: feature-complete MCP server for Huly integration
Static Scan Results
scanned 13d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindings
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/application.cjs9.45 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsNativeBindingsCryptoDynamicRequireHighEntropyStringsUrlStrings127.0.0.1www.eclipse.org
Source & flagged code
4 flaggeddist/index.cjsView file
3// src/resident/native-availability.ts
L4: var import_node_child_process = require("node:child_process");
L5: var import_node_path = require("node:path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.cjsView on unpkg · L3dist/native/huly-stdio-linux-arm64View file
•path = dist/native/huly-stdio-linux-arm64
kind = native_binary
sizeBytes = 368608
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
dist/native/huly-stdio-linux-arm64View on unpkgdist/application.cjsView file
•
Findings
6 Medium4 Low
MediumDynamic Requiredist/index.cjs
MediumEnvironment Vars
MediumShips Native Binarydist/native/huly-stdio-linux-arm64
MediumOversized Source Filedist/application.cjs
MediumOversized Cli Entrypointdist/application.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @firfi/huly-mcp@0.55.4.
See all versions of @firfi/huly-mcp for other recorded verdicts.
- Review the evidence and your use of @firfi/huly-mcp@0.55.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.