registry / @intentweave/cli / 0.16.1

@intentweave/cli@0.16.1

Command-line interface for IntentWeave — iw commands + MCP server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 73 file(s), 1.22 MB of source

Source & flagged code

3 flagged

dist/drift/depsDrift.jsView file

Lines 56-96javascript

56 "esbuild",

57 "rollup",

58 "webpack",

59 "vite",

60 "postcss",

61 "tailwindcss",

62 "autoprefixer",

Source & flagged code

3 flagged · loading source

dist/drift/depsDrift.jsView file

76"buffer", L77: "child_process", L78: "cluster",

High

Child Process

Package source references child process execution.

dist/drift/depsDrift.jsView on unpkg · L76

dist/mcp/server.jsView file

63async function llmComplete(system, userMessage) { L64: const { OpenAILLMProvider } = await import("@intentweave/plugin-llm"); L65: const apiKey = process.env.OPENAI_API_KEY;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/mcp/server.jsView on unpkg · L63

dist/commands/plugin.jsView file

59try { L60: execSync(`npm install -g ${pkg}`, { stdio: "inherit" }); L61: console.log(chalk.green(`✓ ${pkg} installed.`));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/plugin.jsView on unpkg · L59

Findings

3 High3 Medium3 Low

HighChild Processdist/drift/depsDrift.js

HighShell

HighRuntime Package Installdist/commands/plugin.js

MediumDynamic Requiredist/mcp/server.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

dist/mcp/server.jsView file

Lines 43-83javascript

43 * - cari_component_evidence: All CARI evidence for a single architecture component

44 * - cari_living_score: Composite living documentation score (12.3): spec + consistency + freshness + arch

45 * - cari_cypher: CypherLite query over the full CARI graph projection (FILE/SYMBOL/DOCSPAN + CALLS/DEFINES/CO_CHANGES/…)

46 * - cari_graph_schema: Return node labels, relationship types, property names + all built-in templates

47 *

48 * Usage:

49 * iw mcp --session <id> # start stdio MCP server

50 * iw mcp --session <id> --verbose # log activity to stderr

51 */

52import path from "node:path";

53import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

54import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

55import { z } from "zod";

56import { getPluginRegistry } from "@intentweave/core";

57import { buildTopicContext as sharedBuildTopicContext, buildEntityContext as sharedBuildEntityContext, buildFullContext as sharedBuildFullContext, enrichWithDescriptions, enrichWithCodeRefs, formatContextMarkdown as sharedFormatContextMarkdown, } from "../context/index.js";

58import { preflightDocHealth, formatPreflightForAgent, } from "../doc-health/index.js";

59import { createGraphRunner, } from "../persistence/graphRunner.js";

60// =============================================================================

61// LLM helper (for NL → Cypher translation)

62// =============================================================================

63async function llmComplete(system, userMessage) {

64 const { OpenAILLMProvider } = await import("@intentweave/plugin-llm");

65 const apiKey = process.env.OPENAI_API_KEY;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/mcp/server.jsView on unpkg · L63

66 if (!apiKey) {

67 throw new Error("OPENAI_API_KEY environment variable required for natural-language queries.");

68 }

69 const provider = new OpenAILLMProvider({

70 apiKey,

71 model: "gpt-4o-mini",

72 timeoutMs: 30_000,

73 });

74 const response = await provider.complete({

75 system,

76 messages: [{ role: "user", content: userMessage }],

77 temperature: 0,

78 maxTokens: 2048,

79 });

80 if (response.finishReason === "error") {

81 throw new Error(`LLM error: ${response.error}`);

82 }

83 return response.content.trim();

dist/commands/plugin.jsView file

Lines 39-79javascript

39 padRight("Capabilities", 22) +

40 "Description"));

41 console.log(chalk.dim("─".repeat(16) + "─".repeat(10) + "─".repeat(22) + "─".repeat(30)));

42 for (const p of plugins) {

43 const caps = p.capabilities.length > 0 ? p.capabilities.join(", ") : chalk.dim("—");

44 console.log(padRight(p.name, 16) +

45 padRight(p.version, 10) +

46 padRight(caps, 22) +

47 p.description);

48 }

49 console.log(chalk.dim(`\n${plugins.length} plugin(s) installed.`));

50});

51// ─── iw plugin add <name> ────────────────────────────────────────────────────

52pluginCommand

53 .command("add <name>")

54 .description("Install a plugin (e.g., iw plugin add kg)")

55 .option("-g, --global", "Install globally (default)", true)

56 .action(async (name) => {

57 const pkg = resolvePackageName(name);

58 console.log(chalk.blue(`Installing ${pkg}…`));

59 try {

60 execSync(`npm install -g ${pkg}`, { stdio: "inherit" });

61 console.log(chalk.green(`✓ ${pkg} installed.`));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/plugin.jsView on unpkg · L59

62 // Verify it works

63 const registry = getPluginRegistry();

64 await registry.discover((pkg) => import(pkg));

65 const plugin = registry.get(name);

66 if (plugin) {

67 console.log(chalk.green(`✓ Plugin "${plugin.name}" v${plugin.version} registered.`));

68 if (plugin.capabilities?.length) {

69 console.log(chalk.dim(` Capabilities: ${plugin.capabilities.join(", ")}`));

70 }

71 }

72 }

73 catch {

74 console.error(chalk.red(`Failed to install ${pkg}.`));

75 console.error(chalk.dim("Check that the package exists: npm info " + pkg));

76 process.exit(1);

77 }

78});

79// ─── iw plugin remove <name> ────────────────────────────────────────────────