registry / @glidermcp/scout / 0.2.0

@glidermcp/scout@0.2.0

Universal read-only code-intelligence MCP server: fuzzy and strict lexical search over any repository, any language.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 1 file(s), 2.79 KB of source

Source & flagged code

2 flagged

bin/scout.jsView file

Lines 1-69javascript

1#!/usr/bin/env node

2'use strict';

4// Thin launcher for the scout native binary. npm is the delivery channel, not

5// a runtime dependency: this shim only resolves the platform binary shipped by

6// the matching @glidermcp/scout-<platform>-<arch> optional dependency and

7// hands the process over to it. No postinstall, no download, no fallback

8// implementation.

10const { spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/scout.jsView on unpkg · L9

12const PLATFORM_PACKAGES = {

13 'linux-x64': '@glidermcp/scout-linux-x64',

14 'linux-arm64': '@glidermcp/scout-linux-arm64',

15 'darwin-x64': '@glidermcp/scout-darwin-x64',

16 'darwin-arm64': '@glidermcp/scout-darwin-arm64',

17 'win32-x64': '@glidermcp/scout-win32-x64',

18};

20function fail(message) {

21 process.stderr.write(`scout: ${message}\n`);

22 process.exit(1);

23}

25function resolveBinary() {

26 const override = process.env.SCOUT_BINARY_PATH;

27 if (override) {

28 return override;

29 }

31 const key = `${process.platform}-${process.arch}`;

32 const packageName = PLATFORM_PACKAGES[key];

33 if (!packageName) {

34 fail(

35 `no prebuilt binary for ${key}. Supported platforms: ` +

36 `${Object.keys(PLATFORM_PACKAGES).join(', ')}. ` +

37 'Set SCOUT_BINARY_PATH to a locally built scout binary to override.',

38 );

39 }

41 const binaryName = process.platform === 'win32' ? 'scout.exe' : 'scout';

42 try {

43 return require.resolve(`${packageName}/bin/${binaryName}`);

44 } catch {

45 fail(

46 `the platform package ${packageName} is not installed for ${key}. ` +

47 'This usually means the package manager skipped optional dependencies: ' +

48 'a lockfile generated on another platform can omit this platform\'s entry ' +

49 '(the npm optional-dependencies pitfall). Remove node_modules and the ' +

50 'lockfile, reinstall, or run npx with a fresh cache. ' +

51 'Set SCOUT_BINARY_PATH to a locally built scout binary to override.',

52 );

53 }

54}

56const child = spawn(resolveBinary(), process.argv.slice(2), {

57 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/scout.jsView on unpkg · L49

58});

60// Forward termination signals so Ctrl+C / kill reach the native process; the

61// shim then mirrors however the child actually exited.

62for (const signal of ['SIGINT', 'SIGTERM']) {

63 process.on(signal, () => {

64 child.kill(signal);

65 });

66}

68child.on('error', (error) => {

69 fail(`failed to start the scout binary: ${error.message}`);

Source & flagged code

2 flagged · loading source

bin/scout.jsView file

9L10: const { spawn } = require('child_process'); L11:

High

Child Process

Package source references child process execution.

bin/scout.jsView on unpkg · L9

49'(the npm optional-dependencies pitfall). Remove node_modules and the ' + L50: 'lockfile, reinstall, or run npx with a fresh cache. ' + L51: 'Set SCOUT_BINARY_PATH to a locally built scout binary to override.', ... L55: L56: const child = spawn(resolveBinary(), process.argv.slice(2), { L57: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/scout.jsView on unpkg · L49

Findings

2 High2 Medium2 Low

HighChild Processbin/scout.js

HighRuntime Package Installbin/scout.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License

Source & flagged code

2 flagged

bin/scout.jsView file

Lines 1-69javascript

1#!/usr/bin/env node

2'use strict';

4// Thin launcher for the scout native binary. npm is the delivery channel, not

5// a runtime dependency: this shim only resolves the platform binary shipped by

6// the matching @glidermcp/scout-<platform>-<arch> optional dependency and

7// hands the process over to it. No postinstall, no download, no fallback

8// implementation.

10const { spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/scout.jsView on unpkg · L9

12const PLATFORM_PACKAGES = {

13 'linux-x64': '@glidermcp/scout-linux-x64',

14 'linux-arm64': '@glidermcp/scout-linux-arm64',

15 'darwin-x64': '@glidermcp/scout-darwin-x64',

16 'darwin-arm64': '@glidermcp/scout-darwin-arm64',

17 'win32-x64': '@glidermcp/scout-win32-x64',

18};

20function fail(message) {

21 process.stderr.write(`scout: ${message}\n`);

22 process.exit(1);

23}

25function resolveBinary() {

26 const override = process.env.SCOUT_BINARY_PATH;

27 if (override) {

28 return override;

29 }

31 const key = `${process.platform}-${process.arch}`;

32 const packageName = PLATFORM_PACKAGES[key];

33 if (!packageName) {

34 fail(

35 `no prebuilt binary for ${key}. Supported platforms: ` +

36 `${Object.keys(PLATFORM_PACKAGES).join(', ')}. ` +

37 'Set SCOUT_BINARY_PATH to a locally built scout binary to override.',

38 );

39 }

41 const binaryName = process.platform === 'win32' ? 'scout.exe' : 'scout';

42 try {

43 return require.resolve(`${packageName}/bin/${binaryName}`);

44 } catch {

45 fail(

46 `the platform package ${packageName} is not installed for ${key}. ` +

47 'This usually means the package manager skipped optional dependencies: ' +

48 'a lockfile generated on another platform can omit this platform\'s entry ' +

49 '(the npm optional-dependencies pitfall). Remove node_modules and the ' +

50 'lockfile, reinstall, or run npx with a fresh cache. ' +

51 'Set SCOUT_BINARY_PATH to a locally built scout binary to override.',

52 );

53 }

54}

56const child = spawn(resolveBinary(), process.argv.slice(2), {

57 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/scout.jsView on unpkg · L49

58});

60// Forward termination signals so Ctrl+C / kill reach the native process; the

61// shim then mirrors however the child actually exited.

62for (const signal of ['SIGINT', 'SIGTERM']) {

63 process.on(signal, () => {

64 child.kill(signal);

65 });

66}

68child.on('error', (error) => {

69 fail(`failed to start the scout binary: ${error.message}`);