registry  /  @g-digital/mcp-ead-factory  /  1.2.0

@g-digital/mcp-ead-factory@1.2.0

MCP server for EAD Factory: qualified evidence, signature, notifications and chat via AI agents.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 1.64 MB of source, external domains: api-gocertius.gocertius.io, api.gcloudfactory.com, github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist/server.jsView file
36700try { L36701: const lazyImport = new Function("m", "return import(m)"); L36702: _otelApi = await lazyImport("@opentelemetry/api"); ... L36713: meter = "mcp-core"; L36714: endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT ?? "http://localhost:4318"; L36715: recordToolCall(toolName, durationMs, success2, attrs = {}) {
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L36700
5import { isAbsolute, resolve, basename, sep } from 'path'; L6: import { lookup } from 'dns/promises'; L7: import { isIP } from 'net'; ... L1241: // validation function arguments L1242: data: new codegen_1.Name("data"), L1243: // data passed to validation function ... L3113: for (i = 0; i < input.length; i++) { L3114: code = input[i].charCodeAt(0); L3115: if (code === 48) { ... L8671: L8672: // node_modules/thread-stream/package.json L8673: var require_package = __commonJS({
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server.jsView on unpkg · L5
15L16: const require$1 = createRequire(import.meta.url); L17: var __create = Object.create;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L15
36700try { L36701: const lazyImport = new Function("m", "return import(m)"); L36702: _otelApi = await lazyImport("@opentelemetry/api");
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L36700

Findings

3 High4 Medium7 Low
HighChild Process
HighSame File Env Network Executiondist/server.js
HighCloud Metadata Accessdist/server.js
MediumDynamic Requiredist/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/server.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings