registry / @john523100/vela-mcp / 0.8.1

@john523100/vela-mcp@0.8.1

AI-driven dynamic test framework for Electron apps — drive renderer, webview, BrowserView, IPC, main process, breakpoints, console/network capture, and re-runnable specs over MCP.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User or AI agent invokes vela_launch, vela_eval/main_eval, or vela_probe_install.

Impact

An authorized-but-powerful MCP client could execute code in selected debug targets or alter selected local projects.

Mechanism

MCP-controlled Electron/CDP automation and optional source-project patching.

Rationale

This is a powerful, package-aligned Electron testing MCP server rather than concrete malware. Its exposed code-execution and project-write capabilities remain a meaningful AI-agent capability risk.

Evidence

package.jsondist/index.jsdist/launcher.jsdist/cdp.jsdist/probe-install.jsdist/spec.js<projectPath>/package.json<projectPath>/<mainFile><tmpdir>/vela/<sessionId>/screenshot-<uuid>.png<specsDir>/<name>.json

Network endpoints2

127.0.0.1:${port}/rpc127.0.0.1:${port}/health

@john523100/vela-mcp@0.8.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code