@kolbo/mcp@1.87.13

Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 829 KB of source, external domains: api.kolbo.ai, api.us.elevenlabs.io, app.kolbo.ai, assets.sketchfab.com, cdn.coverr.co, cdn.freesound.org, cdn.kolbo.ai, cdn.pixabay.com, cdn.sketchfab.com, coverr.co, fonts.googleapis.com, fonts.gstatic.com, freesound.org, gfbpxdkripkbbrcvoyeh.supabase.co, images.pexels.com, images.unsplash.com, kolbo-general-media.fra1.cdn.digitaloceanspaces.com, kolbo-general-media.fra1.digitaloceanspaces.com, kolbo.ai, media-dev.kolbo.ai, media-staging.kolbo.ai, media.kolbo.ai, media.sketchfab.com, pixabay.com, plus.unsplash.com, sites.kolbo.ai, sketchfab-prod-media.s3.amazonaws.com, sketchfab.com, storage.googleapis.com, upload-api.kolbo.ai, videos.pexels.com, www.w3.org

Source & flagged code

5 flagged

src/apps/index.jsView file

Lines 65-105javascript

65const versionCache = new Map();

66function versionedUri(uri) {

67 if (!versionCache.has(uri)) {

68 const v = crypto.createHash('sha1').update(widgetHtml(uri)).digest('hex').slice(0, 10);

69 versionCache.set(uri, uri + '?v=' + v);

70 }

71 return versionCache.get(uri);

72}

74// Hosts apply a deny-by-default CSP to widget iframes — without this

75// declaration EVERY external asset (generated images/videos on the CDN, model

76// icons, Google Fonts) is silently blocked. resourceDomains maps to

77// img/script/style/font/media-src; connectDomains to connect-src.

78// Every media host cdn.js can hand a widget: each environment's Spaces origin

79// AND the custom domain it gets rewritten to. DERIVED from HOST_MAP, never

80// retyped — the two lists drifted, this one carrying production only, and the

81// result was silent: 565 of 864 production voice documents still store

82// development-bucket thumbnails, cdn.js rewrote them to media-dev.kolbo.ai,

83// and the host's img-src blocked every one. A dev- or staging-pointed MCP had

84// it worse — nothing with a picture in it rendered at all. Add an environment

85// to HOST_MAP and its CSP entry now comes with it.

86const KOLBO_MEDIA_DOMAINS = [...new Set(HOST_MAP.flat())].map((host) => `https://${host}`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/apps/index.jsView on unpkg · L85

88const WIDGET_CSP = {

89 resourceDomains: [

90 // Public hosts owned by Kolbo.

91 'https://api.kolbo.ai',

92 'https://app.kolbo.ai',

93 'https://cdn.kolbo.ai',

94 // Preset thumbnails and library media live on the media-* hosts (prod

95 // presets still reference media-dev); without these every preset tile

96 // rendered as a black box. All three are on kolbo-api's download allowlist.

97 'https://media.kolbo.ai',

98 'https://media-staging.kolbo.ai',

99 'https://media-dev.kolbo.ai',

100 ...KOLBO_MEDIA_DOMAINS,

101 'https://kolbo-general-media.fra1.digitaloceanspaces.com',

102 'https://kolbo-general-media.fra1.cdn.digitaloceanspaces.com',

103

104 // Fonts used by the shared widget shell.

105 'https://fonts.googleapis.com',

src/tools/_shared.jsView file

Lines 1-30javascript

1/* Shared helpers for MCP tools. No server.tool() registrations here.

2 *

3 * This file centralizes the URL-or-local-path → Buffer resolver used by

4 * every tool that accepts file-ish arguments (visual_dna, elements,

5 * first_last_frame, lipsync, video_from_video, transcription, media upload,

6 * future additions). It also owns the SSRF guard applied to any URL we

7 * fetch on the user's local machine.

8 *

9 * SSRF defense in depth:

10 * 1. Only http: / https: protocols.

skill/scripts/filmmaking/lint_prompt.pyView file

•path = skill/scripts/filmmaking/lint_prompt.py kind = build_helper sizeBytes = 9452 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/filmmaking/lint_prompt.pyView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

5 flagged · loading source

src/apps/index.jsView file

85// to HOST_MAP and its CSP entry now comes with it. L86: const KOLBO_MEDIA_DOMAINS = [...new Set(HOST_MAP.flat())].map((host) => `https://${host}`); L87: ... L196: function appsEnabled(server, opts = {}) { L197: if (process.env.KOLBO_MCP_APPS === '0') return false; L198: if (opts.apps === true || process.env.KOLBO_MCP_APPS === '1') return true;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/apps/index.jsView on unpkg · L85

src/tools/_shared.jsView file

10* 1. Only http: / https: protocols. L11: * 2. Block IP literals in private / loopback / link-local / multicast / L12: * reserved ranges (IPv4 and IPv6). ... L24: const path = require('path'); L25: const net = require('net'); L26: const dns = require('dns').promises; L27: const { Agent, fetch: undiciFetch } = require('undici'); ... L259: if (done) break; L260: const chunk = Buffer.from(value); L261: total += chunk.length; ... L536: const buffer = await readResponseBuffer(res, maxBytes); L537: return { type: 'image', data: buffer.toString('base64'), mimeType: contentType };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/tools/_shared.jsView on unpkg · L10

Findings

3 High4 Medium6 Low

HighCloud Metadata Accesssrc/tools/_shared.js

HighSemantic Analysis Limitedpackage.json

HighPrevious Version Dangerous Deltasrc/tools/_shared.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskill/scripts/filmmaking/lint_prompt.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/apps/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @kolbo/mcp@1.87.13.

See all versions of @kolbo/mcp for other recorded verdicts.

Review the evidence and your use of @kolbo/mcp@1.87.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 08:26:45.365Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.