registry / @kryptosai/mcp-observatory / 1.35.1

@kryptosai/mcp-observatory@1.35.1

MCP security scanner and CI gate. Test, secure, and monitor MCP servers with attack simulation, schema drift detection, health scoring, and SARIF before agents depend on them.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 110 file(s), 675 KB of source, external domains: docs.oasis-open.org, github.com, img.shields.io, mcp-observatory-api.kryptosai.workers.dev, mcp-observatory-telemetry.kryptosai.workers.dev, registry.modelcontextprotocol.io, registry.smithery.ai, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 91-131json

91 "examples/insecure-mcp-server",

92 "scripts/postinstall.mjs",

93 "schemas"

94 ],

95 "scripts": {

96 "build": "tsc -p tsconfig.json",

97 "cli": "tsx src/cli.ts",

98 "dashboard:build": "tsx scripts/build-dashboard.ts",

99 "metrics:collect": "tsx scripts/metrics-dashboard.ts collect",

100 "metrics:build": "tsx scripts/metrics-dashboard.ts build",

101 "metrics:refresh": "tsx scripts/metrics-dashboard.ts refresh",

102 "metrics:open": "tsx scripts/metrics-dashboard.ts open",

103 "metrics:serve": "tsx scripts/metrics-dashboard.ts serve",

104 "integration:real": "tsx scripts/run-real-server-matrix.ts",

105 "evaluate:permission-delta": "tsx scripts/evaluate-permission-delta-conformance.ts",

106 "evaluate:permission-delta:mcp-diff": "tsx scripts/run-mcp-diff-baseline.ts",

107 "intel:run": "tsx scripts/enterprise-intel.ts",

108 "safety-index": "tsx scripts/run-safety-index.ts",

109 "lint": "eslint .",

110 "prepack": "npm run build",

111 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L111

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L111

112 "proof:refresh": "tsx scripts/refresh-proof-artifacts.ts",

113 "release:prep": "node scripts/release.mjs",

114 "certification:pr-body": "tsx scripts/print-certification-pr-body.ts",

115 "typecheck": "tsc --noEmit -p tsconfig.json && npm --prefix api install && npm --prefix api run typecheck",

116 "test": "vitest run",

117 "test:permission-delta-model": "vitest run tests/permission-delta-model.test.ts",

118 "test:coverage": "vitest run --coverage",

119 "validate:artifacts": "tsx scripts/validate-artifacts.ts",

120 "verify:packed-install": "node scripts/verify-packed-install.mjs",

121 "smoke": "npm run cli -- run --target tests/fixtures/sample-target-config.json && npm run cli -- diff tests/fixtures/sample-run-a.json tests/fixtures/sample-run-b.json",

122 "telemetry:export": "tsx scripts/export-telemetry-d1.ts",

123 "telemetry:intelligence": "tsx scripts/telemetry-company-intelligence.ts --input telemetry-exports/events-flat-full.json --out-dir reports",

124 "telemetry:external": "tsx scripts/telemetry-company-intelligence.ts --input telemetry-exports/events-flat-full.json --out-dir reports"

125 },

126 "keywords": [

127 "mcp",

128 "mcp-server",

129 "model-context-protocol",

130 "ai-agent",

131 "agent-security",

dist/src/ci-issue.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { mkdtemp, rm, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/src/ci-issue.jsView on unpkg · L1

3import { tmpdir } from "node:os";

dist/src/commands/test.jsView file

Lines 222-262javascript

222 }

223 else {

224 await maybeConvertPassingCheckToCi({

225 artifact,

226 target,

227 targetPath: options.target,

228 setupCi: conversionFlags.setupCi,

229 yes: conversionFlags.yes,

230

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code