@kolbo/mcp@1.81.9

⚠ Under review

Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 721 KB of source, external domains: api.kolbo.ai, app.kolbo.ai, assets.sketchfab.com, cdn.coverr.co, cdn.freesound.org, cdn.kolbo.ai, cdn.pixabay.com, cdn.sketchfab.com, coverr.co, fonts.googleapis.com, fonts.gstatic.com, freesound.org, gfbpxdkripkbbrcvoyeh.supabase.co, images.pexels.com, images.unsplash.com, kolbo-general-media.fra1.cdn.digitaloceanspaces.com, kolbo-general-media.fra1.digitaloceanspaces.com, kolbo.ai, kolboai-production.ams3.cdn.digitaloceanspaces.com, kolboai-production.ams3.digitaloceanspaces.com, media.kolbo.ai, media.sketchfab.com, pixabay.com, plus.unsplash.com, sites.kolbo.ai, sketchfab-prod-media.s3.amazonaws.com, sketchfab.com, videos.pexels.com, www.w3.org

Source & flagged code

4 flagged

src/tools/_shared.jsView file

Lines 1-30javascript

1/* Shared helpers for MCP tools. No server.tool() registrations here.

2 *

3 * This file centralizes the URL-or-local-path → Buffer resolver used by

4 * every tool that accepts file-ish arguments (visual_dna, elements,

5 * first_last_frame, lipsync, video_from_video, transcription, media upload,

6 * future additions). It also owns the SSRF guard applied to any URL we

7 * fetch on the user's local machine.

8 *

9 * SSRF defense in depth:

10 * 1. Only http: / https: protocols.

11 * 2. Block IP literals in private / loopback / link-local / multicast /

12 * reserved ranges (IPv4 and IPv6).

13 * 3. Block common internal hostnames (localhost, *.local, *.internal,

14 * metadata.google.internal, metadata.goog).

15 * 4. Manual redirect following so every hop is re-validated (a crafted

16 * public URL could 302 to 169.254.169.254 — global fetch would follow

17 * silently).

18 *

19 * If you add a new tool that fetches URLs, import resolveToBuffer from here

20 * rather than reinventing the guard.

21 */

23const fs = require('fs');

24const path = require('path');

25const net = require('net');

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/tools/_shared.jsView on unpkg · L10

27const MAX_FILE_BYTES = 500 * 1024 * 1024; // 500 MB — larger than visual_dna because

28 // lipsync/v2v/transcription accept full

29 // videos and long audio tracks.

30const VISUAL_DNA_MAX_BYTES = 25 * 1024 * 1024; // kept for visual_dna backward-compat

skill/scripts/filmmaking/lint_prompt.pyView file

•path = skill/scripts/filmmaking/lint_prompt.py kind = build_helper sizeBytes = 9452 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/filmmaking/lint_prompt.pyView on unpkg

src/apps/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/apps/index.js#virtual:normalized:round1View on unpkg

src/client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kolbo/mcp@1.89.3 matchedIdentity = npm:QGtvbGJvL21jcA:1.89.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client.jsView on unpkg

Source & flagged code

4 flagged · loading source

src/tools/_shared.jsView file

10* 1. Only http: / https: protocols. L11: * 2. Block IP literals in private / loopback / link-local / multicast / L12: * reserved ranges (IPv4 and IPv6). ... L24: const path = require('path'); L25: const net = require('net'); L26: ... L230: } L231: const arrayBuf = await res.arrayBuffer(); L232: const buffer = Buffer.from(arrayBuf); ... L425: if (ab.byteLength > INLINE_IMG_MAX_BYTES) return null; L426: return { type: 'image', data: Buffer.from(ab).toString('base64'), mimeType: contentType }; L427: } catch (_) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/tools/_shared.jsView on unpkg · L10

skill/scripts/filmmaking/lint_prompt.pyView file

•path = skill/scripts/filmmaking/lint_prompt.py kind = build_helper sizeBytes = 9452 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/filmmaking/lint_prompt.pyView on unpkg

Findings

3 High4 Medium5 Low

HighCloud Metadata Accesssrc/tools/_shared.js

HighSemantic Analysis Limitedsrc/apps/index.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltasrc/client.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskill/scripts/filmmaking/lint_prompt.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @kolbo/mcp@1.81.9.

See all versions of @kolbo/mcp for other recorded verdicts.

Review the evidence and your use of @kolbo/mcp@1.81.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 18:08:59.191Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.