registry / @jafish/wingman-mcp / 0.4.1

@jafish/wingman-mcp@0.4.1

Wingman — Claude Code 的僚机 MCP server，提供摘要、压缩和 diff 初筛工具

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 350 KB of source, external domains: api.deepseek.com

Source & flagged code

1 flagged

dist/chat-client.jsView file

Lines 1-26javascript

1/**

2 * Chat client — sends chat completion requests to the configured model endpoint.

3 *

4 * Implements HTTP 安全策略 from PLAN.md:

5 * - HTTPS enforcement (with opt-in localhost HTTP)

6 * - Host allowlist

7 * - SSRF prevention (private / link-local / loopback / cloud metadata)

8 * - Timeout via AbortController

9 * - Retry on transient errors (network errors, 5xx) with exponential backoff

10 * - API key passed as Bearer token, never logged

11 */

12import { lookup } from "node:dns/promises";

13import { URL } from "node:url";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chat-client.jsView on unpkg · L6

14import { logger } from "./logger.js";

15import { recordToolUsage } from "./tool-stats.js";

16// ---------------------------------------------------------------------------

17// Error types

18// ---------------------------------------------------------------------------

19export class ChatClientError extends Error {

20 code;

21 constructor(message, code) {

22 super(message);

23 this.name = "ChatClientError";

24 this.code = code;

25 }

26}

Source & flagged code

1 flagged · loading source

dist/chat-client.jsView file

6* - Host allowlist L7: * - SSRF prevention (private / link-local / loopback / cloud metadata) L8: * - Timeout via AbortController ... L11: */ L12: import { lookup } from "node:dns/promises"; L13: import { URL } from "node:url"; ... L454: try { L455: const text = await response.text(); L456: bodyPreview = text.slice(0, 200);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chat-client.jsView on unpkg · L6

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/chat-client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/chat-client.jsView file

Lines 1-26javascript

1/**

2 * Chat client — sends chat completion requests to the configured model endpoint.

3 *

4 * Implements HTTP 安全策略 from PLAN.md:

5 * - HTTPS enforcement (with opt-in localhost HTTP)

6 * - Host allowlist

7 * - SSRF prevention (private / link-local / loopback / cloud metadata)

8 * - Timeout via AbortController

9 * - Retry on transient errors (network errors, 5xx) with exponential backoff

10 * - API key passed as Bearer token, never logged

11 */

12import { lookup } from "node:dns/promises";

13import { URL } from "node:url";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chat-client.jsView on unpkg · L6

14import { logger } from "./logger.js";

15import { recordToolUsage } from "./tool-stats.js";

16// ---------------------------------------------------------------------------

17// Error types

18// ---------------------------------------------------------------------------

19export class ChatClientError extends Error {

20 code;

21 constructor(message, code) {

22 super(message);

23 this.name = "ChatClientError";

24 this.code = code;

25 }

26}