registry / @lovinka/deployik-mcp / 1.0.1

@lovinka/deployik-mcp@1.0.1

MCP server for Deployik — drive projects, deployments, secrets, and domains from any MCP-aware AI.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 345 KB of source, external domains: 10.x.x.x, 127.0.0.1, deployik.lovinka.com, lovinka.com, www.apple.com, www.google.com

Source & flagged code

1 flagged

dist/install-daemon.jsView file

Lines 1-28javascript

1// Install a long-lived deployik-mcp daemon via macOS launchd.

2//

3// The daemon (src/daemon.ts) is one HTTP process on 127.0.0.1, shared by

4// every Claude Code window. This module owns the install/uninstall side:

5//

6// 1. Write a launchd plist (~/Library/LaunchAgents/com.lovinka.deployik-mcp.plist)

7// that runs `node <absolute path>/dist/daemon.js` with KeepAlive=true,

8// RunAtLoad=true, and DEPLOYIK_* in EnvironmentVariables.

9// 2. Bootstrap it via `launchctl bootout` (clear any old version) +

10// `launchctl bootstrap gui/$UID <plist>`.

11// 3. Rewrite Claude configs: replace the old stdio entry

12// ({ command: "npx", args: [...], env: {...} }) with

13// ({ type: "http", url: "http://127.0.0.1:8788/mcp" }).

14// 4. Uninstall reverses all three.

15//

16// Token lives only in the plist's <EnvironmentVariables>. Plist file is

17// chmod 0600 — readable by the current user only. Other users on the box

18// would need root to read it.

19import { execFileSync } from "node:child_process";

20import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";

21import { homedir, platform } from "node:os";

22import { dirname, join, resolve } from "node:path";

23export const DAEMON_LABEL = "com.lovinka.deployik-mcp";

24export const DEFAULT_DAEMON_PORT = 8788;

25export const DEFAULT_URL = "https://deployik.lovinka.com";

26const MCP_NAME = "deployik";

27/** Where the staged daemon runtime lives — outside any TCC-protected folder. */

28function runtimeDir() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-daemon.jsView on unpkg · L8

Source & flagged code

1 flagged · loading source

dist/install-daemon.jsView file

8// RunAtLoad=true, and DEPLOYIK_* in EnvironmentVariables. L9: // 2. Bootstrap it via `launchctl bootout` (clear any old version) + L10: // `launchctl bootstrap gui/$UID <plist>`. ... L12: // ({ command: "npx", args: [...], env: {...} }) with L13: // ({ type: "http", url: "http://127.0.0.1:8788/mcp" }). L14: // 4. Uninstall reverses all three. ... L18: // would need root to read it. L19: import { execFileSync } from "node:child_process"; L20: import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs"; ... L28: function runtimeDir() { L29: return join(homedir(), ".deployik-mcp", "runtime"); L30: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-daemon.jsView on unpkg · L8

Findings

4 Medium5 Low

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install-daemon.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/install-daemon.jsView file

Lines 1-28javascript

1// Install a long-lived deployik-mcp daemon via macOS launchd.

2//

3// The daemon (src/daemon.ts) is one HTTP process on 127.0.0.1, shared by

4// every Claude Code window. This module owns the install/uninstall side:

5//

6// 1. Write a launchd plist (~/Library/LaunchAgents/com.lovinka.deployik-mcp.plist)

7// that runs `node <absolute path>/dist/daemon.js` with KeepAlive=true,

8// RunAtLoad=true, and DEPLOYIK_* in EnvironmentVariables.

9// 2. Bootstrap it via `launchctl bootout` (clear any old version) +

10// `launchctl bootstrap gui/$UID <plist>`.

11// 3. Rewrite Claude configs: replace the old stdio entry

12// ({ command: "npx", args: [...], env: {...} }) with

13// ({ type: "http", url: "http://127.0.0.1:8788/mcp" }).

14// 4. Uninstall reverses all three.

15//

16// Token lives only in the plist's <EnvironmentVariables>. Plist file is

17// chmod 0600 — readable by the current user only. Other users on the box

18// would need root to read it.

19import { execFileSync } from "node:child_process";

20import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";

21import { homedir, platform } from "node:os";

22import { dirname, join, resolve } from "node:path";

23export const DAEMON_LABEL = "com.lovinka.deployik-mcp";

24export const DEFAULT_DAEMON_PORT = 8788;

25export const DEFAULT_URL = "https://deployik.lovinka.com";

26const MCP_NAME = "deployik";

27/** Where the staged daemon runtime lives — outside any TCC-protected folder. */

28function runtimeDir() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-daemon.jsView on unpkg · L8