registry / @revealui/mcp / 0.7.1

@revealui/mcp@0.7.1

Model Context Protocol framework — MCP server hypervisor, adapter pattern, tool discovery, and adapters for Stripe, Supabase, and Vercel.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 292 KB of source, external domains: api.stripe.com, console.neon.tech, dashboard.stripe.com, github.com, gmail.googleapis.com, oauth2.googleapis.com, supabase.com, vercel.com, www.googleapis.com

Source & flagged code

6 flagged

dist/hypervisor.jsView file

Lines 1-35javascript

1/**

2 * MCP Hypervisor

3 *

4 * Manages N running MCP server processes, pings them for liveness, and

5 * dynamically exposes their tools at runtime. Inspired by the

6 * MCPCompatibilityLayer/MCPHypervisor pattern from AnythingLLM.

7 *

8 * Architecture:

9 * - Singleton: one hypervisor per process manages all MCP servers

10 * - Each server is spawned with piped stdio for JSON-RPC communication

11 * - Tool names are namespaced: @@mcp_{serverName}_{toolName}

12 * - Health check loop: every 60s, process.exitCode check + tools/list probe

13 *

14 * Wire format: newline-delimited JSON-RPC 2.0 (stdin/stdout)

15 */

16import { spawn } from 'node:child_process';

17import { registerCleanupHandler } from '@revealui/core/monitoring';

High

Child Process

Package source references child process execution.

dist/hypervisor.jsView on unpkg · L15

18import { logger } from '@revealui/core/observability/logger';

19// =============================================================================

20// Constants

21// =============================================================================

22const HEALTH_CHECK_INTERVAL_MS = 60_000;

23const REQUEST_TIMEOUT_MS = 5_000;

24const MCP_TOOL_PREFIX = '@@mcp';

25// =============================================================================

26// MCPHypervisor

27// =============================================================================

28/**

29 * Singleton that manages MCP server processes and their tool registries.

30 *

31 * @example

32 * ```typescript

33 * const hypervisor = MCPHypervisor.getInstance()

34 *

35 * hypervisor.registerServer({

dist/servers/factories/knowledge-graph.jsView file

Lines 439-479javascript

439 naturalKey: rankedNodes.find((n) => n.id === anchorId)?.naturalKey ?? anchorId,

440 },

441 nodeCount: rankedNodes.length,

442 factCount: rankedFacts.length,

443 charBudget: opts.charBudget,

444

dist/servers/supabase.jsView file

Lines 73-113javascript

73 }

74 else {

75 logger.info(' Using legacy API key format (anon/service_role JWT)');

76 logger.warning(' Consider migrating to new keys before Nov 2025');

77 logger.info(' See: https://github.com/orgs/supabase/discussions/29260');

78 }

79 // Build env once - used for all spawn attempts

dist/servers/factories/contracts.d.tsView file

Lines 2001-2041typescript

2001 description: z.ZodOptional<z.ZodString>;

2002 tags: z.ZodOptional<z.ZodArray<z.ZodString>>;

2003 aiGenerated: z.ZodOptional<z.ZodBoolean>;

2004 sourcePrompt: z.ZodOptional<z.ZodString>;

Source & flagged code

6 flagged · loading source

dist/hypervisor.jsView file

15*/ L16: import { spawn } from 'node:child_process'; L17: import { registerCleanupHandler } from '@revealui/core/monitoring';

High

Child Process

Package source references child process execution.

dist/hypervisor.jsView on unpkg · L15

dist/servers/factories/knowledge-graph.jsView file

459return cachedExecutor; L460: const poolModule = await import('@revealui/db/pool'); L461: cachedExecutor = makePoolExecutor(poolModule.getPool());

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/servers/factories/knowledge-graph.jsView on unpkg · L459

dist/servers/supabase.jsView file

93const spawnSupabase = () => new Promise((resolve) => { L94: const child = spawn('pnpm', ['dlx', 'supabase-mcp'], { stdio: 'inherit', env: spawnEnv }); L95: child.on('error', (error) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/servers/supabase.jsView on unpkg · L93

dist/servers/factories/contracts.d.tsView file

2021patternName = generic_password severity = medium line = 2021 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/servers/factories/contracts.d.ts

dist/servers/factories/contracts.d.tsView on unpkg · L2021

2432patternName = generic_password severity = medium line = 2432 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/servers/factories/contracts.d.ts

dist/servers/factories/contracts.d.tsView on unpkg · L2432

3714patternName = generic_password severity = medium line = 3714 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/servers/factories/contracts.d.ts

dist/servers/factories/contracts.d.tsView on unpkg · L3714

Findings

3 High7 Medium4 Low

HighChild Processdist/hypervisor.js

HighShell

HighRuntime Package Installdist/servers/supabase.js

MediumDynamic Requiredist/servers/factories/knowledge-graph.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/servers/factories/contracts.d.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/hypervisor.jsView file

Lines 1-35javascript

1/**

2 * MCP Hypervisor

3 *

4 * Manages N running MCP server processes, pings them for liveness, and

5 * dynamically exposes their tools at runtime. Inspired by the

6 * MCPCompatibilityLayer/MCPHypervisor pattern from AnythingLLM.

7 *

8 * Architecture:

9 * - Singleton: one hypervisor per process manages all MCP servers

10 * - Each server is spawned with piped stdio for JSON-RPC communication

11 * - Tool names are namespaced: @@mcp_{serverName}_{toolName}

12 * - Health check loop: every 60s, process.exitCode check + tools/list probe

13 *

14 * Wire format: newline-delimited JSON-RPC 2.0 (stdin/stdout)

15 */

16import { spawn } from 'node:child_process';

17import { registerCleanupHandler } from '@revealui/core/monitoring';

High

Child Process

Package source references child process execution.

dist/hypervisor.jsView on unpkg · L15

18import { logger } from '@revealui/core/observability/logger';

19// =============================================================================

20// Constants

21// =============================================================================

22const HEALTH_CHECK_INTERVAL_MS = 60_000;

23const REQUEST_TIMEOUT_MS = 5_000;

24const MCP_TOOL_PREFIX = '@@mcp';

25// =============================================================================

26// MCPHypervisor

27// =============================================================================

28/**

29 * Singleton that manages MCP server processes and their tool registries.

30 *

31 * @example

32 * ```typescript

33 * const hypervisor = MCPHypervisor.getInstance()

34 *

35 * hypervisor.registerServer({

dist/servers/factories/knowledge-graph.jsView file

Lines 439-479javascript

439 naturalKey: rankedNodes.find((n) => n.id === anchorId)?.naturalKey ?? anchorId,

440 },

441 nodeCount: rankedNodes.length,

442 factCount: rankedFacts.length,

443 charBudget: opts.charBudget,

444

dist/servers/supabase.jsView file

Lines 73-113javascript

73 }

74 else {

75 logger.info(' Using legacy API key format (anon/service_role JWT)');

76 logger.warning(' Consider migrating to new keys before Nov 2025');

77 logger.info(' See: https://github.com/orgs/supabase/discussions/29260');

78 }

79 // Build env once - used for all spawn attempts

dist/servers/factories/contracts.d.tsView file

Lines 2001-2041typescript

2001 description: z.ZodOptional<z.ZodString>;

2002 tags: z.ZodOptional<z.ZodArray<z.ZodString>>;

2003 aiGenerated: z.ZodOptional<z.ZodBoolean>;

2004 sourcePrompt: z.ZodOptional<z.ZodString>;

Lines 2412-2452typescript

2412 description: z.ZodOptional<z.ZodString>;

2413 tags: z.ZodOptional<z.ZodArray<z.ZodString>>;

2414 aiGenerated: z.ZodOptional<z.ZodBoolean>;

2415 sourcePrompt: z.ZodOptional<z.ZodString>;

2416 lastEditor: z.ZodOptional<z.ZodString>;

2417 lastEditedAt: z.ZodOptional<z.ZodString>;

2418 }, z.core.$strip>>;

2419 type: z.ZodLiteral<"form">;

2420 data: z.ZodObject<{

2421 action: z.ZodOptional<z.ZodURL>;

2422 method: z.ZodDefault<z.ZodEnum<{

2423 GET: "GET";

2424 POST: "POST";

2425 }>>;

2426 fields: z.ZodArray<z.ZodObject<{

2427 id: z.ZodString;

2428 type: z.ZodEnum<{

2429 file: "file";

2430 text: "text";

2431 email: "email";

2432 password: "password";

Medium

Secret Pattern

Hardcoded password in dist/servers/factories/contracts.d.ts

dist/servers/factories/contracts.d.tsView on unpkg · L2432

2433 textarea: "textarea";

2434 select: "select";

2435 checkbox: "checkbox";

2436 radio: "radio";

2437 }>;

2438 name: z.ZodString;

2439 label: z.ZodString;

2440 placeholder: z.ZodOptional<z.ZodString>;

2441 required: z.ZodDefault<z.ZodBoolean>;

2442 options: z.ZodOptional<z.ZodArray<z.ZodObject<{

2443 value: z.ZodString;

2444 label: z.ZodString;

2445 }, z.core.$strip>>>;

2446 }, z.core.$strip>>;

2447 submitText: z.ZodDefault<z.ZodString>;

2448 }, z.core.$strip>;

2449 }, z.core.$strip>;

2450 readonly grid: z.ZodObject<{

2451 id: z.ZodString;

2452 style: z.ZodOptional<z.ZodObject<{

Lines 3694-3734typescript

3694 description: z.ZodOptional<z.ZodString>;

3695 tags: z.ZodOptional<z.ZodArray<z.ZodString>>;

3696 aiGenerated: z.ZodOptional<z.ZodBoolean>;

3697 sourcePrompt: z.ZodOptional<z.ZodString>;

3698 lastEditor: z.ZodOptional<z.ZodString>;

3699 lastEditedAt: z.ZodOptional<z.ZodString>;

3700 }, z.core.$strip>>;

3701 type: z.ZodLiteral<"form">;

3702 data: z.ZodObject<{

3703 action: z.ZodOptional<z.ZodURL>;

3704 method: z.ZodDefault<z.ZodEnum<{

3705 GET: "GET";

3706 POST: "POST";

3707 }>>;

3708 fields: z.ZodArray<z.ZodObject<{

3709 id: z.ZodString;

3710 type: z.ZodEnum<{

3711 file: "file";

3712 text: "text";

3713 email: "email";

3714 password: "password";

Medium

Secret Pattern

Hardcoded password in dist/servers/factories/contracts.d.ts

dist/servers/factories/contracts.d.tsView on unpkg · L3714

3715 textarea: "textarea";

3716 select: "select";

3717 checkbox: "checkbox";

3718 radio: "radio";

3719 }>;

3720 name: z.ZodString;

3721 label: z.ZodString;

3722 placeholder: z.ZodOptional<z.ZodString>;

3723 required: z.ZodDefault<z.ZodBoolean>;

3724 options: z.ZodOptional<z.ZodArray<z.ZodObject<{

3725 value: z.ZodString;

3726 label: z.ZodString;

3727 }, z.core.$strip>>>;

3728 }, z.core.$strip>>;

3729 submitText: z.ZodDefault<z.ZodString>;

3730 }, z.core.$strip>;

3731 }, z.core.$strip>, z.ZodObject<{

3732 id: z.ZodString;

3733 style: z.ZodOptional<z.ZodObject<{

3734 align: z.ZodOptional<z.ZodEnum<{