registry / @heretyc/subagent-mcp / 2.12.14

@heretyc/subagent-mcp@2.12.14

MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 389 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

5 flagged

package.jsonView file

Lines 19-59json

19 ],

20 "type": "module",

21 "main": "dist/index.js",

22 "bin": {

23 "subagent-mcp": "dist/index.js"

24 },

25 "files": [

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

4import { z } from "zod"; L5: import { spawn, spawnSync, execSync } from "child_process"; L6: import { unlinkSync, existsSync, realpathSync, readFileSync, writeFileSync, rmSync } from "node:fs"; ... L33: const deadlockWindow = createDeadlockWindow(); L34: const STDOUT_RING_BYTES = 2 * 1024 * 1024; L35: export const AGENT_RETENTION_MS = 30 * 60 * 1000; ... L107: const SPAWN_GRACE_MS = (() => { L108: const raw = process.env.SUBAGENT_SPAWN_GRACE_MS; L109: if (raw === undefined || raw === "") ... L172: try { L173: const parsed = JSON.parse(text); L174: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

dist/advanced-ruleset.pyView file

•path = dist/advanced-ruleset.py kind = build_helper sizeBytes = 2989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/advanced-ruleset.pyView on unpkg

dist/drivers.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @heretyc/subagent-mcp@2.12.13 matchedIdentity = npm:QGhlcmV0eWMvc3ViYWdlbnQtbWNw:2.12.13 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/drivers.jsView on unpkg

Findings

3 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/index.js

HighPrevious Version Dangerous Deltadist/drivers.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/advanced-ruleset.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import { z } from "zod";

5import { spawn, spawnSync, execSync } from "child_process";

6import { unlinkSync, existsSync, realpathSync, readFileSync, writeFileSync, rmSync } from "node:fs";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

7import { randomUUID } from "crypto";

8import { isAbsolute, basename, join, dirname } from "node:path";

9import { tmpdir } from "node:os";

10import { pathToFileURL } from "url";

11import { buildCommand } from "./effort.js";

12import { createProviderDriver } from "./drivers.js";

13import { resolveExeFor } from "./platform.js";

14import { formatLocalIso, selectUnreported, selectUnreportedPermissionRequested, } from "./wait-helpers.js";

15import { computeStatusTransition, buildLivenessFields, reconcilePermissionStatus, } from "./status-helpers.js";

16import { escapeUntrustedTags, envelopeUntrustedOutput, extractFinalTurn, } from "./output-helpers.js";

17import { consumeStreamChunk, flushStream, isTurnCompletedLine, retainLastN, } from "./stream-helpers.js";

18import { loadRoutingTable, buildCandidates, validatePresence, TASK_CATEGORIES, AUTO_HINT, SPLIT_HINT, } from "./routing.js";

19import { createDeadlockWindow } from "./deadlock.js";

20import { createRulesetGate, RULESET_HARD_FAIL_MSG, } from "./ruleset.js";

21import { CONFIG_FILENAME, NONBLOCKING_CULL_DEPS, ZOMBIE_FORCE_GRACE_MS, ZOMBIE_LIVE_IDLE_MS, ZOMBIE_TERMINAL_IDLE_MS, buildProcessTreeKillCommands, drainZombieIntents, drainZombieReports, defaultConfigPath, globalCapMessage, readSlotMetadata, readMergedPermissionConfig, readPermissionsCeiling, readGlobalCap, releaseSlot, reserveSlot, slotDir, writeSlotMetadata, } from "./concurrency.js";

22import { shouldReapTerminalButAlive } from "./zombie.js";

23import * as orchestrationMarker from "./orchestration/marker.js";

24import * as modelMode from "./orchestration/model-mode.js";