registry / @kolbo/mcp / 1.114.2
@kolbo/mcp@1.114.2
⚠ Under reviewKolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code
Static Scan Results
scanned 9d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcesrc/apps/index.jsView file
93// to HOST_MAP and its CSP entry now comes with it.
L94: const KOLBO_MEDIA_DOMAINS = [...new Set(HOST_MAP.flat())].map((host) => `https://${host}`);
L95:
...
L226: function appsEnabled(server, opts = {}) {
L227: if (process.env.KOLBO_MCP_APPS === '0') return false;
L228: if (opts.apps === true || process.env.KOLBO_MCP_APPS === '1') return true;
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/apps/index.jsView on unpkg · L93src/tools/_shared.jsView file
10* 1. Only http: / https: protocols.
L11: * 2. Block IP literals in private / loopback / link-local / multicast /
L12: * reserved ranges (IPv4 and IPv6).
...
L24: const path = require('path');
L25: const net = require('net');
L26: const dns = require('dns').promises;
L27: // Never load Bun's incomplete built-in undici shim. Node uses the installed
...
L294: if (done) break;
L295: const chunk = Buffer.from(value);
L296: total += chunk.length;
...
L571: const buffer = await readResponseBuffer(res, maxBytes);
L572: return { type: 'image', data: buffer.toString('base64'), mimeType: contentType };
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
src/tools/_shared.jsView on unpkg · L10Findings
3 High4 Medium6 Low
HighCloud Metadata Accesssrc/tools/_shared.js
HighSemantic Analysis Limitedsrc/apps/index.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/tools/_shared.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskill/scripts/micro-drama/media.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/apps/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @kolbo/mcp@1.114.2.
See all versions of @kolbo/mcp for other recorded verdicts.
- Review the evidence and your use of @kolbo/mcp@1.114.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.