registry / @pawells/mcp-memory / 2.1.0

@pawells/mcp-memory@2.1.0

Model Context Protocol server for semantic memory and knowledge management with Claude Code

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 206 KB of source

Source & flagged code

2 flagged

dist/services/secrets-detector.jsView file

Lines 83-123javascript

83 regex: /xox[baprs]-[a-zA-Z0-9-]{10,}/g,

84 confidence: 'high',

85 description: 'Slack token'

86 },

Source & flagged code

2 flagged · loading source

dist/services/secrets-detector.jsView file

103patternName = private_key_rsa severity = critical line = 103 matchedText = regex: /..."/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/secrets-detector.jsView on unpkg · L103

103patternName = private_key_rsa severity = critical line = 103 matchedText = regex: /..."/g,

Critical

Secret Pattern

RSA private key in dist/services/secrets-detector.js

dist/services/secrets-detector.jsView on unpkg · L103

Findings

2 Critical2 Medium2 Low

CriticalCritical Secretdist/services/secrets-detector.js

CriticalSecret Patterndist/services/secrets-detector.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LPM CLI

Source & flagged code

2 flagged

dist/services/secrets-detector.jsView file

Lines 83-123javascript

83 regex: /xox[baprs]-[a-zA-Z0-9-]{10,}/g,

84 confidence: 'high',

85 description: 'Slack token'

86 },

87 // AWS

88 {

89 type: 'aws_credentials',

90 regex: /AKIA[0-9A-Z]{16}/g,

91 confidence: 'high',

92 description: 'AWS access key'

93 },

94 {

95 type: 'aws_credentials',

96 regex: /aws_secret_access_key\s*=\s*[a-zA-Z0-9/+=]{40}/gi,

97 confidence: 'high',

98 description: 'AWS secret access key'

99 },

100 // GCP

101 {

102 type: 'gcp_credentials',

103 regex: /"private_key":\s*"-----BEGIN PRIVATE KEY-----[^"]+-----END PRIVATE KEY-----"/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/secrets-detector.jsView on unpkg · L103

Critical

Secret Pattern

RSA private key in dist/services/secrets-detector.js

dist/services/secrets-detector.jsView on unpkg · L103

104 confidence: 'high',

105 description: 'GCP service account key'

106 },

107 // Azure

108 {

109 type: 'azure_credentials',

110 regex: /DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[a-zA-Z0-9+/=]{88}/g,

111 confidence: 'high',

112 description: 'Azure storage connection string'

113 },

114 // JWT tokens

115 {

116 type: 'jwt_token',

117 regex: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,

118 confidence: 'high',

119 description: 'JWT token'

120 },

121 // Bearer tokens

122 {

123 type: 'bearer_token',