registry / @kolbo/mcp / 1.84.2
@kolbo/mcp@1.84.2
Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcebin/kolbo-mcp.jsView file
9if (command === 'install' || command === 'skill' || command === 'install-skill') {
L10: const installer = require('../src/install.js');
L11: const run = command === 'install' ? installer.run : installer.runSkillOnly;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/kolbo-mcp.jsView on unpkg · L9src/tools/_shared.jsView file
10* 1. Only http: / https: protocols.
L11: * 2. Block IP literals in private / loopback / link-local / multicast /
L12: * reserved ranges (IPv4 and IPv6).
...
L24: const path = require('path');
L25: const net = require('net');
L26:
...
L230: }
L231: const arrayBuf = await res.arrayBuffer();
L232: const buffer = Buffer.from(arrayBuf);
...
L425: if (ab.byteLength > INLINE_IMG_MAX_BYTES) return null;
L426: return { type: 'image', data: Buffer.from(ab).toString('base64'), mimeType: contentType };
L427: } catch (_) {
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
src/tools/_shared.jsView on unpkg · L10Findings
2 High5 Medium5 Low
HighCloud Metadata Accesssrc/tools/_shared.js
HighSemantic Analysis Limitedpackage.json
MediumDynamic Requirebin/kolbo-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskill/scripts/filmmaking/lint_prompt.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @kolbo/mcp@1.84.2.
See all versions of @kolbo/mcp for other recorded verdicts.
- Review the evidence and your use of @kolbo/mcp@1.84.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.