registry / @invokehq/foundry / 0.8.0

@invokehq/foundry@0.8.0

Forge AI agents locally with a governed workspace — exactly-once, receipted, no account needed. Deploy to Invoke when you're ready.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 117 KB of source, external domains: api.github.com, api.invokehq.run, api.openai.com, invokehq.run, mcp.deepwiki.com

Source & flagged code

4 flagged

src/commands.jsView file

Lines 1-24javascript

1"use strict";

2const fs = require("node:fs");

3const path = require("node:path");

Source & flagged code

4 flagged · loading source

src/commands.jsView file

4

const readline = require("node:readline"); L5: const { spawn } = require("node:child_process"); L6: const store = require("./store");

High

Child Process

Package source references child process execution.

src/commands.jsView on unpkg · L4

4const readline = require("node:readline"); L5: const { spawn } = require("node:child_process"); L6: const store = require("./store"); ... L34: function openBrowser(url) { L35: const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open"; L36: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; ... L40: return new Promise((resolve) => { L41: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); L42: rl.question(question, (a) => { rl.close(); resolve(a.trim()); }); ... L57: if (found) return { dir: found, created: false }; L58: const dir = process.cwd(); L59: store.writeProject(dir, { name: path.basename(dir) || "foundry", agent: { id: "builder", tool: "http.get", params: { url: "https://api.github.com/zen" } }, invoke: { workspace: nul...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = @invokehq/foundry@0.7.0 matchedIdentity = npm:QGludm9rZWhxL2ZvdW5kcnk:0.7.0 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands.jsView on unpkg

src/mcp.jsView file

13// Uses node:https with family:4 (not global fetch): some hosts advertise AAAA records L14: // but have broken IPv6, and undici can pick the dead v6 address and time out. L15: const http = require("node:http"); L16: const https = require("node:https"); L17: const { spawn } = require("node:child_process"); L18: const { URL } = require("node:url"); ... L23: L24: // `${VAR}` → process.env.VAR. This is what keeps tokens out of connectors.json: the file L25: // holds the reference, the value lives in your environment.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/mcp.jsView on unpkg · L13

Findings

4 High3 Medium4 Low

HighChild Processsrc/commands.js

HighSame File Env Network Executionsrc/mcp.js

HighSandbox Evasion Gated Capabilitysrc/commands.js

HighPrevious Version Dangerous Deltasrc/commands.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Source & flagged code

4 flagged

src/commands.jsView file

Lines 1-24javascript

1"use strict";

2const fs = require("node:fs");

3const path = require("node:path");

4const readline = require("node:readline");

5const { spawn } = require("node:child_process");

6const store = require("./store");

High

Child Process

Package source references child process execution.

src/commands.jsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands.jsView on unpkg · L4

7const { Ledger } = require("./ledger");

8const { runTool, BUILTINS, toolType } = require("./tools");

9const mcp = require("./mcp");

10const policy = require("./policy");

11const cloud = require("./cloud");

12const memory = require("./memory");

13const red = (s) => `\x1b[31m${s}\x1b[0m`;

14

15// Execute a tool locally: a connector tool ("<connector>.<tool>") proxies to its MCP

16// server; otherwise it's a built-in. The ledger (dedup + receipt) wraps this in run().

17async function executeLocal(dir, tool, params) {

18 const conns = store.readConnectors(dir);

19 // `memory.*` is a reserved namespace: the Context layer, governed like any Execution.

20 if (tool.startsWith("memory.")) return memory.runMemoryTool(dir, tool, params);

21 const dot = tool.indexOf(".");

22 if (dot > 0) {

23 const cname = tool.slice(0, dot);

24 if (conns[cname]) return mcp.call(conns[cname], tool.slice(dot + 1), params);

•matchType = previous_version_dangerous_delta matchedPackage = @invokehq/foundry@0.7.0 matchedIdentity = npm:QGludm9rZWhxL2ZvdW5kcnk:0.7.0 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands.jsView on unpkg

src/mcp.jsView file

Lines 1-33javascript

1"use strict";

2// Minimal Model Context Protocol client — enough for Foundry to connect a *real* MCP

3// server and govern its tools through the ledger. Two transports, because the ecosystem

4// has two shapes:

5//

6// http — hosted servers (deepwiki, Vercel). Streamable HTTP + optional auth header.

7// stdio — the majority: launched via npx (Slack, GitHub, Postgres, filesystem, …),

8// speaking newline-delimited JSON-RPC over the child's stdin/stdout.

9//

10// Secrets never touch disk: header values and env vars are stored as `${VAR}` templates

11// in connectors.json and resolved from the environment at call time.

12//

13// Uses node:https with family:4 (not global fetch): some hosts advertise AAAA records

14// but have broken IPv6, and undici can pick the dead v6 address and time out.

15const http = require("node:http");

16const https = require("node:https");

17const { spawn } = require("node:child_process");

18const { URL } = require("node:url");

19

20const PROTOCOL = "2025-06-18";

21const CLIENT = { name: "foundry", version: require("../package.json").version };

22const TIMEOUT_MS = 30000;

23

24// `${VAR}` → process.env.VAR. This is what keeps tokens out of connectors.json: the file

25// holds the reference, the value lives in your environment.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/mcp.jsView on unpkg · L13

26function resolveEnv(str) {

27 return String(str).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => process.env[name] || "");

28}

29

30// A connector is either a bare URL (legacy), an http descriptor, or a stdio descriptor.

31function normalize(conn) {

32 if (typeof conn === "string") return { transport: "http", url: conn, headers: {} };

33 if (conn && conn.command) {