registry / @microsoft/fabric-mcp / 1.2.0

@microsoft/fabric-mcp@1.2.0

Microsoft Fabric MCP Server - Model Context Protocol implementation for Fabric

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVars

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.29 KB of source, external domains: aka.ms, github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 23-48json

23 "bin": {

24 "fabmcp": "./index.js"

25 },

26 "os": [

27 "linux",

28 "darwin",

29 "win32"

30 ],

31 "cpu": [

32 "x64",

33 "arm64"

34 ],

35 "optionalDependencies": {

36 "@microsoft/fabric-mcp-darwin-x64": "1.2.0",

37 "@microsoft/fabric-mcp-win32-arm64": "1.2.0",

38 "@microsoft/fabric-mcp-win32-x64": "1.2.0",

39 "@microsoft/fabric-mcp-linux-x64": "1.2.0",

40 "@microsoft/fabric-mcp-darwin-arm64": "1.2.0",

41 "@microsoft/fabric-mcp-linux-arm64": "1.2.0"

42 },

43 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L43

44 "postinstall": "node ./scripts/post-install-script.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

45 },

46 "mcpName": "com.microsoft/microsoft-fabric"

47}

index.jsView file

Lines 1-68javascript

1#!/usr/bin/env node

3const os = require('os')

4const packageJson = require('./package.json')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

6// Check if DEBUG environment variable is set

7const isDebugMode = process.env.DEBUG && (

8 process.env.DEBUG.toLowerCase() === 'true' ||

9 process.env.DEBUG.includes('mcp') ||

10 process.env.DEBUG === '*'

11)

13// Helper function for debug logging

14function debugLog(...args) {

15 if (isDebugMode) {

16 console.error(...args)

17 }

18}

20debugLog('\nWrapper package starting')

21debugLog('All args:')

22process.argv.forEach((val, index) => {

23 debugLog(`${index}: ${val}`)

24})

26const platform = os.platform()

27const arch = os.arch()

29const packageName = packageJson.name

30const packageVersion = packageJson.version

31const platformPackageName = `${packageName}-${platform}-${arch}`

33// Try to load the platform package

34let platformPackage

35try {

36 debugLog(`Attempting to require platform package: ${platformPackageName}`)

37 platformPackage = require(platformPackageName)

38} catch (err) {

39 debugLog(`Failed to require ${platformPackageName}, attempting auto-install: ${err.message}`)

41 // Try to automatically install the missing platform package

42 try {

43 const { execSync } = require('child_process')

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L42

45 console.error(`Installing missing platform package: ${platformPackageName}`)

47 // Try to install the platform package

48 try {

49 execSync(`npm install ${platformPackageName}@${packageVersion}`, {

50 stdio: ['inherit', 'inherit', 'pipe'], // Only pipe stderr to capture errors

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L48

51 timeout: 60000 // 60 second timeout

52 })

53 } catch (npmErr) {

54 // If npm install fails, try with --no-save and different install strategies

55 debugLog(`npm install failed, trying alternative installation methods: ${npmErr.message}`)

57 // Try with --no-save and --prefer-online

58 execSync(`npm install ${platformPackageName}@${packageVersion} --no-save --prefer-online`, {

59 stdio: ['inherit', 'inherit', 'pipe'],

60 timeout: 60000

61 })

62 }

64 // Clear module cache and try to require again after installation

65 Object.keys(require.cache).forEach(key => {

66 if (key.includes(platformPackageName)) {

67 delete require.cache[key]

68 }

Source & flagged code

5 flagged · loading source

package.jsonView file

•dependencies registry_only=@microsoft/fabric-mcp-darwin-arm64,@microsoft/fabric-mcp-darwin-x64,@microsoft/fabric-mcp-linux-arm64,@microsoft/fabric-mcp-linux-x64,@microsoft/fabric-mcp-win32-arm64,@microsoft/fabric-mcp-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/post-install-script.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

42try { L43: const { execSync } = require('child_process') L44:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L42

48try { L49: execSync(`npm install ${platformPackageName}@${packageVersion}`, { L50: stdio: ['inherit', 'inherit', 'pipe'], // Only pipe stderr to capture errors

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L48

2L3: const os = require('os') L4: const packageJson = require('./package.json')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

Findings

1 Critical3 High3 Medium2 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processindex.js

HighRuntime Package Installindex.js

MediumDynamic Requireindex.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 23-48json

23 "bin": {

24 "fabmcp": "./index.js"

25 },

26 "os": [

27 "linux",

28 "darwin",

29 "win32"

30 ],

31 "cpu": [

32 "x64",

33 "arm64"

34 ],

35 "optionalDependencies": {

36 "@microsoft/fabric-mcp-darwin-x64": "1.2.0",

37 "@microsoft/fabric-mcp-win32-arm64": "1.2.0",

38 "@microsoft/fabric-mcp-win32-x64": "1.2.0",

39 "@microsoft/fabric-mcp-linux-x64": "1.2.0",

40 "@microsoft/fabric-mcp-darwin-arm64": "1.2.0",

41 "@microsoft/fabric-mcp-linux-arm64": "1.2.0"

42 },

43 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L43

44 "postinstall": "node ./scripts/post-install-script.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

45 },

46 "mcpName": "com.microsoft/microsoft-fabric"

47}

index.jsView file

Lines 1-68javascript

1#!/usr/bin/env node

3const os = require('os')

4const packageJson = require('./package.json')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

6// Check if DEBUG environment variable is set

7const isDebugMode = process.env.DEBUG && (

8 process.env.DEBUG.toLowerCase() === 'true' ||

9 process.env.DEBUG.includes('mcp') ||

10 process.env.DEBUG === '*'

11)

13// Helper function for debug logging

14function debugLog(...args) {

15 if (isDebugMode) {

16 console.error(...args)

17 }

18}

20debugLog('\nWrapper package starting')

21debugLog('All args:')

22process.argv.forEach((val, index) => {

23 debugLog(`${index}: ${val}`)

24})

26const platform = os.platform()

27const arch = os.arch()

29const packageName = packageJson.name

30const packageVersion = packageJson.version

31const platformPackageName = `${packageName}-${platform}-${arch}`

33// Try to load the platform package

34let platformPackage

35try {

36 debugLog(`Attempting to require platform package: ${platformPackageName}`)

37 platformPackage = require(platformPackageName)

38} catch (err) {

39 debugLog(`Failed to require ${platformPackageName}, attempting auto-install: ${err.message}`)

41 // Try to automatically install the missing platform package

42 try {

43 const { execSync } = require('child_process')

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L42

45 console.error(`Installing missing platform package: ${platformPackageName}`)

47 // Try to install the platform package

48 try {

49 execSync(`npm install ${platformPackageName}@${packageVersion}`, {

50 stdio: ['inherit', 'inherit', 'pipe'], // Only pipe stderr to capture errors

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L48

51 timeout: 60000 // 60 second timeout

52 })

53 } catch (npmErr) {

54 // If npm install fails, try with --no-save and different install strategies

55 debugLog(`npm install failed, trying alternative installation methods: ${npmErr.message}`)

57 // Try with --no-save and --prefer-online

58 execSync(`npm install ${platformPackageName}@${packageVersion} --no-save --prefer-online`, {

59 stdio: ['inherit', 'inherit', 'pipe'],

60 timeout: 60000

61 })

62 }

64 // Clear module cache and try to require again after installation

65 Object.keys(require.cache).forEach(key => {

66 if (key.includes(platformPackageName)) {

67 delete require.cache[key]

68 }