@kolbo/mcp@1.105.1

⚠ Under review

Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 958 KB of source, external domains: api.kolbo.ai, api.us.elevenlabs.io, app.kolbo.ai, assets.sketchfab.com, cdn.coverr.co, cdn.freesound.org, cdn.kolbo.ai, cdn.pixabay.com, cdn.sketchfab.com, coverr.co, fonts.googleapis.com, fonts.gstatic.com, freesound.org, gfbpxdkripkbbrcvoyeh.supabase.co, images.pexels.com, images.unsplash.com, kolbo-general-media.fra1.cdn.digitaloceanspaces.com, kolbo-general-media.fra1.digitaloceanspaces.com, kolbo.ai, media-dev.kolbo.ai, media-staging.kolbo.ai, media.kolbo.ai, media.sketchfab.com, pixabay.com, plus.unsplash.com, sites.kolbo.ai, sketchfab-prod-media.s3.amazonaws.com, sketchfab.com, storage.googleapis.com, upload-api.kolbo.ai, videos.pexels.com, www.w3.org

Source & flagged code

5 flagged

src/apps/index.jsView file

Lines 73-113javascript

73const versionCache = new Map();

74function versionedUri(uri) {

75 if (!versionCache.has(uri)) {

76 const v = crypto.createHash('sha1').update(widgetHtml(uri)).digest('hex').slice(0, 10);

77 versionCache.set(uri, uri + '?v=' + v);

78 }

79 return versionCache.get(uri);

80}

82// Hosts apply a deny-by-default CSP to widget iframes — without this

83// declaration EVERY external asset (generated images/videos on the CDN, model

84// icons, Google Fonts) is silently blocked. resourceDomains maps to

85// img/script/style/font/media-src; connectDomains to connect-src.

86// Every media host cdn.js can hand a widget: each environment's Spaces origin

87// AND the custom domain it gets rewritten to. DERIVED from HOST_MAP, never

88// retyped — the two lists drifted, this one carrying production only, and the

89// result was silent: 565 of 864 production voice documents still store

90// development-bucket thumbnails, cdn.js rewrote them to media-dev.kolbo.ai,

91// and the host's img-src blocked every one. A dev- or staging-pointed MCP had

92// it worse — nothing with a picture in it rendered at all. Add an environment

93// to HOST_MAP and its CSP entry now comes with it.

94const KOLBO_MEDIA_DOMAINS = [...new Set(HOST_MAP.flat())].map((host) => `https://${host}`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/apps/index.jsView on unpkg · L93

96const WIDGET_CSP = {

97 resourceDomains: [

98 // Public hosts owned by Kolbo.

99 'https://api.kolbo.ai',

100 'https://app.kolbo.ai',

101 'https://cdn.kolbo.ai',

102 // Preset thumbnails and library media live on the media-* hosts (prod

103 // presets still reference media-dev); without these every preset tile

104 // rendered as a black box. All three are on kolbo-api's download allowlist.

105 'https://media.kolbo.ai',

106 'https://media-staging.kolbo.ai',

107 'https://media-dev.kolbo.ai',

108 ...KOLBO_MEDIA_DOMAINS,

109 'https://kolbo-general-media.fra1.digitaloceanspaces.com',

110 'https://kolbo-general-media.fra1.cdn.digitaloceanspaces.com',

111

112 // Fonts used by the shared widget shell.

113 'https://fonts.googleapis.com',

src/tools/_shared.jsView file

Lines 1-30javascript

1/* Shared helpers for MCP tools. No server.tool() registrations here.

2 *

3 * This file centralizes the URL-or-local-path → Buffer resolver used by

4 * every tool that accepts file-ish arguments (visual_dna, elements,

5 * first_last_frame, lipsync, video_from_video, transcription, media upload,

6 * future additions). It also owns the SSRF guard applied to any URL we

7 * fetch on the user's local machine.

8 *

9 * SSRF defense in depth:

10 * 1. Only http: / https: protocols.

skill/scripts/filmmaking/lint_prompt.pyView file

•path = skill/scripts/filmmaking/lint_prompt.py kind = build_helper sizeBytes = 12585 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/filmmaking/lint_prompt.pyView on unpkg

src/apps/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/apps/index.js#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged · loading source

src/apps/index.jsView file

93// to HOST_MAP and its CSP entry now comes with it. L94: const KOLBO_MEDIA_DOMAINS = [...new Set(HOST_MAP.flat())].map((host) => `https://${host}`); L95: ... L226: function appsEnabled(server, opts = {}) { L227: if (process.env.KOLBO_MCP_APPS === '0') return false; L228: if (opts.apps === true || process.env.KOLBO_MCP_APPS === '1') return true;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/apps/index.jsView on unpkg · L93

src/tools/_shared.jsView file

10* 1. Only http: / https: protocols. L11: * 2. Block IP literals in private / loopback / link-local / multicast / L12: * reserved ranges (IPv4 and IPv6). ... L24: const path = require('path'); L25: const net = require('net'); L26: const dns = require('dns').promises; L27: // Never load Bun's incomplete built-in undici shim. Node uses the installed ... L293: if (done) break; L294: const chunk = Buffer.from(value); L295: total += chunk.length; ... L570: const buffer = await readResponseBuffer(res, maxBytes); L571: return { type: 'image', data: buffer.toString('base64'), mimeType: contentType };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/tools/_shared.jsView on unpkg · L10

Findings

3 High4 Medium6 Low

HighCloud Metadata Accesssrc/tools/_shared.js

HighSemantic Analysis Limitedsrc/apps/index.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltasrc/tools/_shared.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskill/scripts/filmmaking/lint_prompt.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/apps/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @kolbo/mcp@1.105.1.

See all versions of @kolbo/mcp for other recorded verdicts.

Review the evidence and your use of @kolbo/mcp@1.105.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 16:11:07.765Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.