registry / @frase/mcp-server / 0.4.3

@frase/mcp-server@0.4.3

Frase MCP Server — The complete content platform for AI agents. Research, write, optimize, and host SEO & GEO-optimized content with built-in AI search visibility monitoring. Includes Frase CMS for auto-optimized web hosting, 95 tools, 9 agent skills, and

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 1.91 MB of source, external domains: dotenvx.com, frase.io, github.com, json-schema.org, next.frase.io, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

3 flagged

dist/cli/init.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Frase MCP Server — Interactive Setup

4 *

5 * Usage: npx @frase/mcp-server init

6 *

7 * Detects installed AI tools, prompts for API key,

8 * and auto-configures the MCP server.

9 */

10import

Source & flagged code

3 flagged · loading source

dist/cli/init.jsView file

11import { stdin, stdout } from "node:process"; L12: import { execSync } from "node:child_process"; L13: import { detectTools } from "./detect-tool.js";

High

Child Process

Package source references child process execution.

dist/cli/init.jsView on unpkg · L11

4* L5: * Usage: npx @frase/mcp-server init L6: * ... L11: import { stdin, stdout } from "node:process"; L12: import { execSync } from "node:child_process"; L13: import { detectTools } from "./detect-tool.js";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/init.jsView on unpkg · L4

dist/mcpb-bundle.jsView file

2960sourceCode = this.opts.code.process(sourceCode, sch); L2961: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2962: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcpb-bundle.jsView on unpkg · L2960

Findings

3 High3 Medium7 Low

HighChild Processdist/cli/init.js

HighShell

HighRuntime Package Installdist/cli/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/mcpb-bundle.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings