registry / @paigy/mcp / 0.8.4

@paigy/mcp@0.8.4

Paigy MCP server — a voice inbox for your AI agents. Lets an agent notify a user and await their reply.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 39.2 KB of source, external domains: paigy.ai

Source & flagged code

3 flagged

dist/index.jsView file

Lines 13-98javascript

13 submitNotification

14} from "./chunk-SLK7NHHQ.js";

15import {

16 deleteToken,

17 openBrowser,

18 pollToken,

19 readToken,

20 requestCode,

21 revokeToken,

22 saveToken,

23 sleep

24} from "./chunk-AILC3H3U.js";

25import "./chunk-GU7C5H6L.js";

27// src/index.ts

28import { Server } from "@modelcontextprotocol/sdk/server/index.js";

29import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

30import {

31 CallToolRequestSchema,

32 ListToolsRequestSchema

33} from "@modelcontextprotocol/sdk/types.js";

34import { execSync } from "child_process";

35import { z } from "zod";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L33

37// src/schema.ts

38import { zodToJsonSchema } from "zod-to-json-schema";

39function draft2020(node) {

40 if (Array.isArray(node)) return node.map(draft2020);

41 if (node && typeof node === "object") {

42 const o = node;

43 for (const [excl, lim] of [["exclusiveMinimum", "minimum"], ["exclusiveMaximum", "maximum"]]) {

44 if (typeof o[excl] === "boolean") {

45 if (o[excl] === true && typeof o[lim] === "number") {

46 o[excl] = o[lim];

47 delete o[lim];

48 } else delete o[excl];

49 }

50 }

51 for (const k of Object.keys(o)) o[k] = draft2020(o[k]);

52 return o;

53 }

58 delete schema.$schema;

59 return draft2020(schema);

60}

62// src/index.ts

63var PollAnswerSchema = z.object({

64 id: z.string().describe("Request id returned by notify_user.")

65});

66var AwaitReplySchema = z.object({

67 notificationId: z.string().describe("The id returned by notify_user \u2014 waits for the user's reply to THIS notification only.")

68});

69var CheckRepliesSchema = z.object({});

70var PairSchema = z.object({

71 device_code: z.string().optional().describe("Omit to start pairing (returns an approval link to show the user). Pass the device_code from that first call to finish, once the user has approved.")

72});

73var SetTaskStateToolSchema = z.object({

74 notificationId: z.string(),

75 state: SetTaskStateSchema.shape.state

76});

77var RegisterDeliveryToolSchema = z.object({

78 mode: DeliveryModeSchema.describe(

79 "'self_hosted' = the API pushes the moment work lands (requires `npx -y @paigy/mcp paigy-listen` running); 'poll' = the default, you catch up via check_replies/await_reply."

80 )

81});

82function detectGit() {

83 const run = (cmd) => {

84 try {

85 return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();

86 } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L78

87 return "";

88 }

89 };

90 const remote = run("git remote get-url origin");

91 const match = remote.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);

92 const branch = run("git rev-parse --abbrev-ref HEAD");

93 return {

94 repo: match ? match[1] : void 0,

95 branch: branch && branch !== "HEAD" ? branch : void 0

96 };

97}

98var server = new Server(

dist/listen.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import {

3 WAKE_EVENT,

4 checkReplies,

5 registerDelivery,

6 wakeChannel

7} from "./chunk-SLK7NHHQ.js";

8import "./chunk-GU7C5H6L.js";

10// src/listen.ts

11import { createClient }

Source & flagged code

3 flagged · loading source

dist/index.jsView file

33} from "@modelcontextprotocol/sdk/types.js"; L34: import { execSync } from "child_process"; L35: import { z } from "zod";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L33

78mode: DeliveryModeSchema.describe( L79: "'self_hosted' = the API pushes the moment work lands (requires `npx -y @paigy/mcp paigy-listen` running); 'poll' = the default, you catch up via check_replies/await_reply." L80: ) ... L84: try { L85: return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim(); L86: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L78

dist/listen.jsView file

19if (cmd && (work.replies.length > 0 || work.requests.length > 0 || work.owedCallbacks.length > 0)) { L20: spawn(cmd, { shell: true, stdio: "inherit" }); L21: }

High

Shell

Package source references shell execution.

dist/listen.jsView on unpkg · L19

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighShelldist/listen.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 13-98javascript

13 submitNotification

14} from "./chunk-SLK7NHHQ.js";

15import {

16 deleteToken,

17 openBrowser,

18 pollToken,

19 readToken,

20 requestCode,

21 revokeToken,

22 saveToken,

23 sleep

24} from "./chunk-AILC3H3U.js";

25import "./chunk-GU7C5H6L.js";

27// src/index.ts

28import { Server } from "@modelcontextprotocol/sdk/server/index.js";

29import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

30import {

31 CallToolRequestSchema,

32 ListToolsRequestSchema

33} from "@modelcontextprotocol/sdk/types.js";

34import { execSync } from "child_process";

35import { z } from "zod";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L33

37// src/schema.ts

38import { zodToJsonSchema } from "zod-to-json-schema";

39function draft2020(node) {

40 if (Array.isArray(node)) return node.map(draft2020);

41 if (node && typeof node === "object") {

42 const o = node;

43 for (const [excl, lim] of [["exclusiveMinimum", "minimum"], ["exclusiveMaximum", "maximum"]]) {

44 if (typeof o[excl] === "boolean") {

45 if (o[excl] === true && typeof o[lim] === "number") {

46 o[excl] = o[lim];

47 delete o[lim];

48 } else delete o[excl];

49 }

50 }

51 for (const k of Object.keys(o)) o[k] = draft2020(o[k]);

52 return o;

53 }

58 delete schema.$schema;

59 return draft2020(schema);

60}

62// src/index.ts

63var PollAnswerSchema = z.object({

64 id: z.string().describe("Request id returned by notify_user.")

65});

66var AwaitReplySchema = z.object({

67 notificationId: z.string().describe("The id returned by notify_user \u2014 waits for the user's reply to THIS notification only.")

68});

69var CheckRepliesSchema = z.object({});

70var PairSchema = z.object({

71 device_code: z.string().optional().describe("Omit to start pairing (returns an approval link to show the user). Pass the device_code from that first call to finish, once the user has approved.")

72});

73var SetTaskStateToolSchema = z.object({

74 notificationId: z.string(),

75 state: SetTaskStateSchema.shape.state

76});

77var RegisterDeliveryToolSchema = z.object({

78 mode: DeliveryModeSchema.describe(

79 "'self_hosted' = the API pushes the moment work lands (requires `npx -y @paigy/mcp paigy-listen` running); 'poll' = the default, you catch up via check_replies/await_reply."

80 )

81});

82function detectGit() {

83 const run = (cmd) => {

84 try {

85 return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();

86 } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L78

87 return "";

88 }

89 };

90 const remote = run("git remote get-url origin");

91 const match = remote.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);

92 const branch = run("git rev-parse --abbrev-ref HEAD");

93 return {

94 repo: match ? match[1] : void 0,

95 branch: branch && branch !== "HEAD" ? branch : void 0

96 };

97}

98var server = new Server(

dist/listen.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import {

3 WAKE_EVENT,

4 checkReplies,

5 registerDelivery,

6 wakeChannel

7} from "./chunk-SLK7NHHQ.js";

8import "./chunk-GU7C5H6L.js";

10// src/listen.ts

11import { createClient }