registry / @groundnuty/macf-channel-server / 0.2.50

@groundnuty/macf-channel-server@0.2.50

MCP channel server for the Multi-Agent Coordination Framework. HTTPS + mTLS endpoint agents connect to for inter-agent messaging (notify), CI-completion routing, and /sign certificate issuance. Invoked by Claude Code's plugin via `npx -y @groundnuty/macf-

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 364 KB of source, external domains: github.com

Source & flagged code

1 flagged

dist/otel.jsView file

Lines 100-140javascript

100 const serviceName = process.env['OTEL_SERVICE_NAME'] ?? 'macf';

101 // Dynamic imports — only resolved when opted in. Lets a workspace

102 // WITHOUT `@opentelemetry/sdk-*` in node_modules start cleanly

103 // (as long as it doesn't opt in). See macf#196 for the bug this

104 // closes; consumer plugin workspaces have only a subset of deps

105 // available via `npm install` unless opted into observability.

106 let sdkNode;

107 let sdkBase;

108 let traceExporter;

109 let sdkMetrics;

110 let metricsExporter;

111 let metricsApi;

112 let resources;

113 let semconv;

114 try {

115 [sdkNode, sdkBase, traceExporter, sdkMetrics, metricsExporter, metricsApi, resources, semconv] = await Promise.all([

116 import('@opentelemetry/sdk-trace-node'),

117 import('@opentelemetry/sdk-trace-base'),

118 import('@opentelemetry/exporter-trace-otlp-proto'),

119 import('@opentelemetry/sdk-metrics'),

120 import('@opentelemetry/exporter-metrics-otlp-proto'),

121 import('@opentelemetry/api'),

122 import('@opentelemetry/resources'),

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/otel.jsView on unpkg · L120

123 import('@opentelemetry/semantic-conventions'),

124 ]);

125 }

126 catch (err) {

127 const msg = err instanceof Error ? err.message : String(err);

128 process.stderr.write(`FATAL: OTEL_EXPORTER_OTLP_ENDPOINT is set ("${endpoint}") but required @opentelemetry/* packages are missing.\n` +

129 ` Underlying error: ${msg}\n` +

130 ` Fix: install them in the plugin dir (e.g. run macf-agent's SessionStart npm-install hook), ` +

131 `or unset OTEL_EXPORTER_OTLP_ENDPOINT to disable telemetry.\n`);

132 process.exit(1);

133 }

134 // Resource = SDK defaults + OTEL_RESOURCE_ATTRIBUTES (gen_ai.agent.name,

135 // gen_ai.agent.role, service.namespace) + explicit service.* on top.

136 // See buildResource() for the merge order + why the env detector is

137 // explicit (groundnuty/macf#427).

138 const resource = buildResource(resources, semconv, serviceName, serviceVersion);

139 const tracerProvider = new sdkNode.NodeTracerProvider({

140 resource,

Source & flagged code

1 flagged · loading source

dist/otel.jsView file

120package = @groundnuty/macf-channel-server; repositoryIdentity = macf; dependency = @opentelemetry/api L120: import('@opentelemetry/exporter-metrics-otlp-proto'), L121: import('@opentelemetry/api'), L122: import('@opentelemetry/resources'),

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/otel.jsView on unpkg · L120

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/otel.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/otel.jsView file

Lines 100-140javascript

100 const serviceName = process.env['OTEL_SERVICE_NAME'] ?? 'macf';

101 // Dynamic imports — only resolved when opted in. Lets a workspace

102 // WITHOUT `@opentelemetry/sdk-*` in node_modules start cleanly

103 // (as long as it doesn't opt in). See macf#196 for the bug this

104 // closes; consumer plugin workspaces have only a subset of deps

105 // available via `npm install` unless opted into observability.

106 let sdkNode;

107 let sdkBase;

108 let traceExporter;

109 let sdkMetrics;

110 let metricsExporter;

111 let metricsApi;

112 let resources;

113 let semconv;

114 try {

115 [sdkNode, sdkBase, traceExporter, sdkMetrics, metricsExporter, metricsApi, resources, semconv] = await Promise.all([

116 import('@opentelemetry/sdk-trace-node'),

117 import('@opentelemetry/sdk-trace-base'),

118 import('@opentelemetry/exporter-trace-otlp-proto'),

119 import('@opentelemetry/sdk-metrics'),

120 import('@opentelemetry/exporter-metrics-otlp-proto'),

121 import('@opentelemetry/api'),

122 import('@opentelemetry/resources'),

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/otel.jsView on unpkg · L120

123 import('@opentelemetry/semantic-conventions'),

124 ]);

125 }

126 catch (err) {

127 const msg = err instanceof Error ? err.message : String(err);

128 process.stderr.write(`FATAL: OTEL_EXPORTER_OTLP_ENDPOINT is set ("${endpoint}") but required @opentelemetry/* packages are missing.\n` +

129 ` Underlying error: ${msg}\n` +

130 ` Fix: install them in the plugin dir (e.g. run macf-agent's SessionStart npm-install hook), ` +

131 `or unset OTEL_EXPORTER_OTLP_ENDPOINT to disable telemetry.\n`);

132 process.exit(1);

133 }

134 // Resource = SDK defaults + OTEL_RESOURCE_ATTRIBUTES (gen_ai.agent.name,

135 // gen_ai.agent.role, service.namespace) + explicit service.* on top.

136 // See buildResource() for the merge order + why the env detector is

137 // explicit (groundnuty/macf#427).

138 const resource = buildResource(resources, semconv, serviceName, serviceVersion);

139 const tracerProvider = new sdkNode.NodeTracerProvider({

140 resource,