registry / @hover-dev/mcp / 0.44.0

@hover-dev/mcp@0.44.0

Hover MCP server — grounded browser actuation + crystallize a Playwright suite, for your own coding agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 95.4 KB of source, external domains: cloud.gethover.dev

Source & flagged code

1 flagged

dist/hook.jsView file

Lines 100-140javascript

100 });

101 } catch {

102 emit({});

103 }

104}

105var GATE_MAX_SPECS = 12;

106var GATE_CDP_URL = `http://localhost:${process.env.HOVER_CDP_PORT || 9222}`;

107async function verifyGate(cwd) {

108 try {

109 const dir = join(cwd, ".hover", "sidecars");

110 const { readdir } = await import("fs/promises");

111 const files = (await readdir(dir).catch(() => [])).filter((f) => f.endsWith(".json"));

112 if (!files.length) return null;

113 const { readSidecar, replayOnPage, launchDebugChrome } = await import("@hover-dev/core/engine");

114 loadHoverEnvFile(cwd);

115 const target = process.env.HOVER_TARGET || readActiveEnv(cwd)?.url || "http://localhost:5173";

116 try {

117 await fetch(target, { signal: AbortSignal.timeout(2e3), redirect: "manual" });

118 } catch {

119 return null;

120 }

121 const { chromium } = await import("playwright-core");

122 let browser;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hook.jsView on unpkg · L120

123 try {

124 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 1500 });

125 } catch {

126 await launchDebugChrome({ port: Number(process.env.HOVER_CDP_PORT || 9222), url: target });

127 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 8e3 });

128 }

129 try {

130 const ctx = browser.contexts()[0] ?? await browser.newContext();

131 const page = ctx.pages()[0] ?? await ctx.newPage();

132 const slugs = files.map((f) => f.replace(/\.json$/, "")).sort().slice(0, GATE_MAX_SPECS);

133 const red = [];

134 let verified = 0;

135 for (const slug of slugs) {

136 const sc = await readSidecar(cwd, slug);

137 if (!sc) continue;

138 if ((sc.redactionEnvVars ?? []).some((v) => process.env[v] === void 0)) continue;

139 const res = await replayOnPage(page, target, sc.steps);

140 verified++;

Source & flagged code

1 flagged · loading source

dist/hook.jsView file

120package = @hover-dev/mcp; repositoryIdentity = hover; dependency = playwright-core L120: } L121: const { chromium } = await import("playwright-core"); L122: let browser;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hook.jsView on unpkg · L120

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/hook.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/hook.jsView file

Lines 100-140javascript

100 });

101 } catch {

102 emit({});

103 }

104}

105var GATE_MAX_SPECS = 12;

106var GATE_CDP_URL = `http://localhost:${process.env.HOVER_CDP_PORT || 9222}`;

107async function verifyGate(cwd) {

108 try {

109 const dir = join(cwd, ".hover", "sidecars");

110 const { readdir } = await import("fs/promises");

111 const files = (await readdir(dir).catch(() => [])).filter((f) => f.endsWith(".json"));

112 if (!files.length) return null;

113 const { readSidecar, replayOnPage, launchDebugChrome } = await import("@hover-dev/core/engine");

114 loadHoverEnvFile(cwd);

115 const target = process.env.HOVER_TARGET || readActiveEnv(cwd)?.url || "http://localhost:5173";

116 try {

117 await fetch(target, { signal: AbortSignal.timeout(2e3), redirect: "manual" });

118 } catch {

119 return null;

120 }

121 const { chromium } = await import("playwright-core");

122 let browser;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hook.jsView on unpkg · L120

123 try {

124 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 1500 });

125 } catch {

126 await launchDebugChrome({ port: Number(process.env.HOVER_CDP_PORT || 9222), url: target });

127 browser = await chromium.connectOverCDP(GATE_CDP_URL, { timeout: 8e3 });

128 }

129 try {

130 const ctx = browser.contexts()[0] ?? await browser.newContext();

131 const page = ctx.pages()[0] ?? await ctx.newPage();

132 const slugs = files.map((f) => f.replace(/\.json$/, "")).sort().slice(0, GATE_MAX_SPECS);

133 const red = [];

134 let verified = 0;

135 for (const slug of slugs) {

136 const sc = await readSidecar(cwd, slug);

137 if (!sc) continue;

138 if ((sc.redactionEnvVars ?? []).some((v) => process.env[v] === void 0)) continue;

139 const res = await replayOnPage(page, target, sc.steps);

140 verified++;