registry / @orangepro/orangepro-mcp / 0.2.6

@orangepro/orangepro-mcp@0.2.6

OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 100 file(s), 1.90 MB of source, external domains: api.anthropic.com, api.openai.com, app.orangepro.ai, cli.github.com, d3js.org, www.w3.org

Source & flagged code

5 flagged

dist/local/score/risk.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/local/score/risk.jsView on unpkg · L1

5const ENTRY_NAME_RE = /(^|[.#])(main|serve|request|endpoint)/i;

6function symbolFile(n) {

7 if (typeof n.properties.file === "string")

8 return n.properties.file;

9 return n.external_id.replace(/^sym:/, "").split("#")[0];

10}

11function symbolTitle(n) {

12 return n.title ?? n.external_id.split("#")[1] ?? n.external_id;

13}

14function confirmedBehaviorIds(graph) {

15 const ids = new Set();

16 const nodeKinds = new Map(graph.nodes.map((n) => [n.external_id, n.kind]));

17 for (const e of graph.edges) {

18 if (e.evidence_strength !== "hard")

19 continue;

20 if (e.relationship_type !== "TESTED_BY" && e.relationship_type !== "COVERS")

21 continue;

dist/local/viz/d3.bundle.jsView file

Lines 1-4javascript

1/* eslint-disable */

2// Vendored D3 v7 (from d3js.org, ISC) for the offline graph explorer.

dist/local/generate/compareReport.jsView file

Lines 209-249javascript

209}

210/**

211 * Full binding identity per LOCAL name declared by one import statement:

212 * local → "<imported>@<module>", where <imported> is the exported symbol

213 * (propertyName for aliases), "default" for default imports, and "*" for

214 * namespace imports. Two imports are interchangeable only when identities

215 * match — same local + same module is NOT enough (`saveCard as subject` and

216 * `deleteCard as subject` are different bindings, as are default/namespace

217 * vs named imports of the same local name).

218

dist/local/operations.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/local/operations.jsView on unpkg · L1

3import { dirname, join, relative, resolve, sep } from "node:path"

scripts/spikes/python-mutate.pyView file

•path = scripts/spikes/python-mutate.py kind = build_helper sizeBytes = 3086 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/spikes/python-mutate.pyView on unpkg

Source & flagged code

5 flagged · loading source

dist/local/score/risk.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code