registry / @monoes/monomindcli / 2.3.0

@monoes/monomindcli@2.3.0

CLI engine for Monomind — an open-source MCP server that extends Claude Code with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. MIT licensed, fully local.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 23 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 372 file(s), 4.42 MB of source, external domains: 127.0.0.1, a2a-protocol.org, accounts.google.com, api.anthropic.com, api.github.com, api.osv.dev, api.pinata.cloud, api.web3.storage, cdnjs.cloudflare.com, cli.github.com, cloud.google.com, cloudflare-ipfs.com, dweb.link, gateway.pinata.cloud, gemini.google.com, generativelanguage.googleapis.com, git-scm.com, github.com, ipfs.io, login.microsoftonline.com, nodejs.org, pinata.cloud, registry.npmjs.org, services.nvd.nist.gov, storage.googleapis.com, w3s.link, web3.storage, www.instagram.com, www.linkedin.com, x.com

Source & flagged code

14 flagged

README.mdView file

•isSafe('Ignore all previous instructions'); // → false (~0.04ms)

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

dist/src/mcp-tools/quality/security-compliance/detect-secrets.jsView file

Lines 262-302javascript

262 const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };

263 return severityOrder[a.severity] - severityOrder[b.severity];

264 });

265 return { findings, scanStats: { filesScanned: files.length, linesScanned: totalLines } };

266}

267function getExposureRisk(severity) {

268 const risks = {

269 critical: 'High risk - immediate unauthorized access possible',

270 high: 'Significant risk - sensitive data exposure likely',

271 medium: 'Moderate risk - potential security issue',

272 low: 'Low risk - minor exposure concern',

273 };

274 return risks[severity] || 'Unknown risk level';

275}

276function getRemediation(type) {

277 const remediations = {

278 'api-key': 'Move API key to environment variable or secrets manager',

279 'aws-key': 'Rotate AWS credentials immediately and use IAM roles',

280 'aws-secret': 'Rotate AWS credentials and use AWS Secrets Manager',

281 'private-key': 'Remove private key from code, store in secure vault',

282 password: 'Use environment variables or secrets manager',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/mcp-tools/quality/security-compliance/detect-secrets.jsView on unpkg · L282

283 token: 'Use secure token storage, implement token rotation',

284 'connection-string': 'Use environment variables for connection strings',

285 'gcp-key': 'Use workload identity instead of service account keys',

286 'azure-key': 'Use Azure Key Vault for credential management',

287 generic: 'Review and move to secure configuration',

288 };

289 return remediations[type] || 'Remove secret from code and use secure storage';

290}

291function calculateSummary(findings) {

292 const counts = { critical: 0, high: 0, medium: 0, low: 0 };

293 for (const finding of findings) {

294 counts[finding.severity]++;

295 }

296 const files = new Set(findings.map((f) => f.location.file));

297 const verifiedCount = findings.filter((f) => f.verified).length;

298 // Calculate risk score

299 const riskScore = Math.max(0, 100 - (counts.critical * 25 + counts.high * 15 + counts.medium * 5 + counts.low *

300 return {

301 totalFindings: findings.length,

302 criticalCount: counts.critical,

dist/workflow/builtin-handlers.jsView file

Lines 48-88javascript

48};

49var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {

50 if (pack ||

dist/src/init/statusline-generator.jsView file

Lines 21-61javascript

21 */

22export function generateStatuslineScript(options) {

23 const maxAgents = options.runtime.maxAgents;

24 return `#!/usr/bin/env node

25/**

dist/src/workflow/condition-evaluator.jsView file

Lines 58-82javascript

58 if (expression.length > 500) {

59 throw new Error('Condition expression too long (max 500 characters)');

60 }

61 // Step 1: substitute variables (string values JSON-encoded to prevent quote injection)

dist/dashboard/server.jsView file

Lines 1-25javascript

1"use strict";

2var _a;

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.startDashboard = startDashboard;

5exports.getDashboard = getDashboard;

dist/src/services/crash-reporter.jsView file

Lines 1-35javascript

1/**

2 * Crash reporter — shared across the monoes tool family.

3 *

4 * monomind's own uncaught-exception handler uses this directly. mono-agent

5 * (Go), monotask, and mono-clip (Rust) shell out to `monomind report-crash`

6 * from their own panic/recover handlers so redaction, dedup, and GitHub auth

7 * logic live in exactly one place instead of being reimplemented per language.

8 *

9 * Default: ON (files real GitHub issues on crash). Opt out with

10 * `monomind crash-reporting disable`.

dist/src/commands/providers.jsView file

Lines 10-50javascript

10const configureCommand = {

11 name: 'configure',

12 description: 'Configure provider settings and API keys',

13 options: [

14 { name: 'provider', short: 'p', type: 'string', description: 'Provider name'

scripts/sync-claude-assets.shView file

•path = scripts/sync-claude-assets.sh kind = build_helper sizeBytes = 979 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/sync-claude-assets.shView on unpkg

.claude/agents/core/reviewer.mdView file

85patternName = generic_password severity = medium line = 85 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L85

.claude/agents/testing/testing-api-tester.mdView file

78patternName = generic_password severity = medium line = 78 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in .claude/agents/testing/testing-api-tester.md

.claude/agents/testing/testing-api-tester.mdView on unpkg · L78

.claude/agents/testing/testing-performance-benchmarker.mdView file

94patternName = generic_password severity = medium line = 94 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in .claude/agents/testing/testing-performance-benchmarker.md

.claude/agents/testing/testing-performance-benchmarker.mdView on unpkg · L94