registry / @frase/mcp-server / 0.7.0
@frase/mcp-server@0.7.0
Frase MCP Server — The complete content platform for AI agents. Research, write, optimize, and host SEO & GEO-optimized content with built-in AI search visibility monitoring. Includes Frase CMS for auto-optimized web hosting, 121 tools, 9 agent skills, an
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
3 flaggeddist/cli/init.jsView file
11import { stdin, stdout } from "node:process";
L12: import { execSync } from "node:child_process";
L13: import { detectTools } from "./detect-tool.js";
High
4*
L5: * Usage: npx @frase/mcp-server init
L6: *
...
L11: import { stdin, stdout } from "node:process";
L12: import { execSync } from "node:child_process";
L13: import { detectTools } from "./detect-tool.js";
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/cli/init.jsView on unpkg · L4dist/mcpb-bundle.jsView file
2960sourceCode = this.opts.code.process(sourceCode, sch);
L2961: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2962: const validate = makeValidate(this, this.scope.get());
Findings
3 High3 Medium6 Low
HighChild Processdist/cli/init.js
HighShell
HighRuntime Package Installdist/cli/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcpb-bundle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @frase/mcp-server@0.7.0.
See all versions of @frase/mcp-server for other recorded verdicts.
- Review the evidence and your use of @frase/mcp-server@0.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.