registry  /  @fokus-app/mcp  /  0.2.0

@fokus-app/mcp@0.2.0

Official MCP server for Fokus — manage tasks, notes, calendar, and objectives from any AI assistant

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 179 KB of source, external domains: api.getfokus.com, getfokus.com

Source & flagged code

1 flagged · loading source
dist/index.jsView file
3// src/cli/login.ts L4: import { spawn } from "child_process"; L5: ... L14: var VERSION = "0.2.0"; L15: var DEFAULT_API_URL = "https://api.getfokus.com"; L16: function normalizeApiUrl(url) { ... L38: function configDir() { L39: if (process.platform === "win32") { L40: const base2 = process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming"); L41: return path.join(base2, "fokus-mcp"); ... L53: const raw = fs.readFileSync(credentialsPath(), "utf8"); L54: const parsed = JSON.parse(raw);
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L3

Findings

1 High3 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings