registry / @invokehq/foundry / 0.13.0

@invokehq/foundry@0.13.0

Forge AI agents locally with a governed workspace — exactly-once, receipted, no account needed. Deploy to Invoke when you're ready.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 168 KB of source, external domains: api.github.com, api.invokehq.run, api.openai.com, invokehq.run, mcp.deepwiki.com

Source & flagged code

4 flagged

src/commands.jsView file

Lines 1-24javascript

1"use strict";

2const fs = require("node:fs");

3const path = require("node:path");

4const readline = require("node:readline");

5const { spawn } = require("node:child_process");

6const store = require("./store");

High

Child Process

Package source references child process execution.

src/commands.jsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands.jsView on unpkg · L4

7const { Ledger } = require("./ledger");

8const { runTool, BUILTINS, toolType } = require("./tools");

9const mcp = require("./mcp");

10const policy = require("./policy");

11const cloud = require("./cloud");

12const memory = require("./memory");

13const embeddings = require("./embeddings");

14const coord = require("./coord");

15const { Approvals } = require("./approvals");

16const red = (s) => `\x1b[31m${s}\x1b[0m`;

18// Execute a tool locally: a connector tool ("<connector>.<tool>") proxies to its MCP

19// server; otherwise it's a built-in. The ledger (dedup + receipt) wraps this in run().

20async function executeLocal(dir, tool, params, project) {

21 const conns = store.readConnectors(dir);

22 // `memory.*` is a reserved namespace: the Context layer, governed like any Execution.

23 if (tool.startsWith("memory.")) return memory.runMemoryTool(dir, tool, params, project || store.readProject(dir));

24 const dot = tool.indexOf(".");

•matchType = previous_version_dangerous_delta matchedPackage = @invokehq/foundry@0.8.0 matchedIdentity = npm:QGludm9rZWhxL2ZvdW5kcnk:0.8.0 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands.jsView on unpkg

src/mcp.jsView file

Lines 1-33javascript

1"use strict";

2// Minimal Model Context Protocol client — enough for Foundry to connect a *real* MCP

3// server and govern its tools through the ledger. Two transports, because the ecosystem

4// has two shapes:

5//

6// http — hosted servers (deepwiki, Vercel). Streamable HTTP + optional auth header.

7// stdio — the majority: launched via npx (Slack, GitHub, Postgres, filesystem, …),

8// speaking newline-delimited JSON-RPC over the child's stdin/stdout.

9//

10// Secrets never touch disk: header values and env vars are stored as `${VAR}` templates

Source & flagged code

4 flagged · loading source

src/commands.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code