registry / @productbrain/mcp / 0.0.1-beta.2490

@productbrain/mcp@0.0.1-beta.2490

Product Brain — MCP server for AI-assisted product knowledge management

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 6 file(s), 801 KB of source, external domains: claude.ai, eu.i.posthog.com, fonts.googleapis.com, fonts.gstatic.com, gateway.productbrain.io, productbrain.io, work.productbrain.io

Source & flagged code

3 flagged

dist/chunk-ZX7WAZLV.jsView file

7501// src/lib/coherence/git-detection.ts L7502: import { execSync } from "child_process"; L7503: function detectTouchedRegistries(projectRoot) {

High

Child Process

Package source references child process execution.

dist/chunk-ZX7WAZLV.jsView on unpkg · L7501

dist/setup-PRWLIQB4.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import {

3 DEFAULT_CLOUD_URL,

4 MCP_NPX_PACKAGE,

5 initAnalytics,

6 resolveClient,

7 shutdownAnalytics,

8 trackSetupCompleted,

9 trackSetupStarted,

10 warnOnProdFallthrough,

11 writeClientConfig

12} from "./chunk-UCYQNZOC.js";

14// src/cli/setup.ts

15import { execSync } from "child_process";

16import { createInterface } from "readline";

17import { existsSync, writeFileSync, mkdirSync } from "fs";

18import { join } from "path";

19var APP_URL = process.env.PRODUCTBRAIN_APP_URL ?? "https://work.productbrain.io";

20function bold(s) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/setup-PRWLIQB4.jsView on unpkg · L14

21 return `\x1B[1m${s}\x1B[0m`;

22}

23function green(s) {

24 return `\x1B[32m${s}\x1B[0m`;

25}

26function dim(s) {

27 return `\x1B[2m${s}\x1B[0m`;

28}

29function orange(s) {

30 return `\x1B[33m${s}\x1B[0m`;

31}

32function log(msg) {

33 process.stdout.write(`${msg}

34`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/setup-PRWLIQB4.jsView on unpkg · L14

Source & flagged code

3 flagged · loading source

dist/chunk-ZX7WAZLV.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code