registry / @s-tier-building-automation/stier-mcp-server / 2.5.1

@s-tier-building-automation/stier-mcp-server@2.5.1

MCP server for STier Web API - Niagara 4 building automation

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Manifest

GitDependencyWildcardDependency

scanned 53 file(s), 962 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 3-43json

3 "version": "2.5.1",

4 "description": "MCP server for STier Web API - Niagara 4 building automation",

5 "main": "dist/index.js",

6 "type": "module",

7 "bin": {

8 "stier-mcp-server": "./dist/index.js"

9 },

10 "files": [

11 "dist"

12 ],

13 "scripts": {

14 "start": "tsx src/index.ts",

15 "build": "prisma generate && tsc",

16 "dev": "tsx watch src/index.ts",

17 "typecheck": "tsc --noEmit",

18 "test": "node --import tsx --test src/__tests__/*.test.ts",

19 "test:compliance": "node --import tsx --test src/__tests__/kit-control-compliance.test.ts",

20 "eval": "tsx evals/runner.ts",

21 "lint": "eslint src --ext .ts",

22 "prepublishOnly": "npm run build && npm run test",

23 "postinstall": "prisma generate || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "engines": {

26 "node": ">=18"

27 },

28 "keywords": [

29 "mcp",

30 "niagara",

31 "building-automation",

32 "stier"

33 ],

34 "author": "S-Tier Building Automation",

35 "license": "MIT",

36 "repository": {

37 "type": "git",

38 "url": "git+https://github.com/S-Tier-Building-Automation/STier-API-N4.git",

39 "directory": "mcp-server"

40 },

41 "publishConfig": {

42 "registry": "https://registry.npmjs.org",

43 "access": "public"

dist/__tests__/telemetry.test.jsView file

Lines 227-267javascript

227 content: [{ type: "text", text: "ok" }],

228 }));

229 await closeTelemetry();

230 const entries = readEntriesAfter(initialEntryCount);

231 const entry = entries.find((e) => e.tool === "auth_tool");

232 assert.ok(entry, "Should find the telemetry entry");

233 assert.strictEqual(entry.args.username, "[REDACTED]");

234 assert.strictEqual(entry.args.user, "[REDACTED]");

235 assert.strictEqual(entry.args.USERNAME, "[REDACTED]", "case-insensitive");

236 assert.strictEqual(entry.args.password, "[REDACTED]");

237 assert.strictEqual(entry.args.path, "/ok");

238 });

239 it("preserves user resource identifiers while still redacting credentials (#1457)", async () => {

240 await withTelemetry("delete_user", {

241 username: "night.operator",

242 password: "hunter2",

243 stationOrd: "foxs://admin:secret@host:4911",

244 }, async () => ({

245 content: [{ type: "text", text: "ok" }],

246 }));

247 await withTelemetry("manage_workbench_connection", { username: "admin", password: "station-secret" }, async () => ({

Medium

Secret Pattern

Hardcoded password in dist/__tests__/telemetry.test.js

dist/__tests__/telemetry.test.jsView on unpkg · L247

248 content: [{ type: "text", text: "ok" }],

249 }));

250 await closeTelemetry();

251 const entries = readEntriesAfter(initialEntryCount);

252 const entry = entries.find((e) => e.tool === "delete_user");

253 const authEntry = entries.find((e) => e.tool === "manage_workbench_connection");

254 assert.ok(entry, "Should find the telemetry entry");

255 assert.ok(authEntry, "Should find the auth-bearing telemetry entry");

256 assert.strictEqual(entry.args.username, "night.operator");

257 assert.strictEqual(entry.args.password, "[REDACTED]");

258 assert.strictEqual(entry.args.stationOrd, "[REDACTED]");

259 assert.strictEqual(authEntry.args.username, "[REDACTED]");

260 assert.strictEqual(authEntry.args.password, "[REDACTED]");

261 });

262 it("redacts stationOrd variants — camelCase, lowercase, and snake_case (#634)", async () => {

263 await withTelemetry("variant_tool", {

264 path: "/ok",

265 stationOrd: "foxs://admin:p1@h:4911",

266 stationord: "foxs://admin:p2@h:4911",

267 STATIONORD: "foxs://admin:p3@h:4911",

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = prisma generate || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = prisma generate || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/__tests__/telemetry.test.jsView file

247patternName = generic_password severity = medium line = 247 matchedText = await wi...> ({

Medium

Secret Pattern

Hardcoded password in dist/__tests__/telemetry.test.js

dist/__tests__/telemetry.test.jsView on unpkg · L247

Findings

1 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumGit Dependency

MediumWildcard Dependency

MediumSecret Patterndist/__tests__/telemetry.test.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 3-43json

3 "version": "2.5.1",

4 "description": "MCP server for STier Web API - Niagara 4 building automation",

5 "main": "dist/index.js",

6 "type": "module",

7 "bin": {

8 "stier-mcp-server": "./dist/index.js"

9 },

10 "files": [

11 "dist"

12 ],

13 "scripts": {

14 "start": "tsx src/index.ts",

15 "build": "prisma generate && tsc",

16 "dev": "tsx watch src/index.ts",

17 "typecheck": "tsc --noEmit",

18 "test": "node --import tsx --test src/__tests__/*.test.ts",

19 "test:compliance": "node --import tsx --test src/__tests__/kit-control-compliance.test.ts",

20 "eval": "tsx evals/runner.ts",

21 "lint": "eslint src --ext .ts",

22 "prepublishOnly": "npm run build && npm run test",

23 "postinstall": "prisma generate || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "engines": {

26 "node": ">=18"

27 },

28 "keywords": [

29 "mcp",

30 "niagara",

31 "building-automation",

32 "stier"

33 ],

34 "author": "S-Tier Building Automation",

35 "license": "MIT",

36 "repository": {

37 "type": "git",

38 "url": "git+https://github.com/S-Tier-Building-Automation/STier-API-N4.git",

39 "directory": "mcp-server"

40 },

41 "publishConfig": {

42 "registry": "https://registry.npmjs.org",

43 "access": "public"

dist/__tests__/telemetry.test.jsView file

Lines 227-267javascript

227 content: [{ type: "text", text: "ok" }],

228 }));

229 await closeTelemetry();

230 const entries = readEntriesAfter(initialEntryCount);

231 const entry = entries.find((e) => e.tool === "auth_tool");

232 assert.ok(entry, "Should find the telemetry entry");

233 assert.strictEqual(entry.args.username, "[REDACTED]");

234 assert.strictEqual(entry.args.user, "[REDACTED]");

235 assert.strictEqual(entry.args.USERNAME, "[REDACTED]", "case-insensitive");

236 assert.strictEqual(entry.args.password, "[REDACTED]");

237 assert.strictEqual(entry.args.path, "/ok");

238 });

239 it("preserves user resource identifiers while still redacting credentials (#1457)", async () => {

240 await withTelemetry("delete_user", {

241 username: "night.operator",

242 password: "hunter2",

243 stationOrd: "foxs://admin:secret@host:4911",

244 }, async () => ({

245 content: [{ type: "text", text: "ok" }],

246 }));

247 await withTelemetry("manage_workbench_connection", { username: "admin", password: "station-secret" }, async () => ({

Medium

Secret Pattern

Hardcoded password in dist/__tests__/telemetry.test.js

dist/__tests__/telemetry.test.jsView on unpkg · L247

248 content: [{ type: "text", text: "ok" }],

249 }));

250 await closeTelemetry();

251 const entries = readEntriesAfter(initialEntryCount);

252 const entry = entries.find((e) => e.tool === "delete_user");

253 const authEntry = entries.find((e) => e.tool === "manage_workbench_connection");

254 assert.ok(entry, "Should find the telemetry entry");

255 assert.ok(authEntry, "Should find the auth-bearing telemetry entry");

256 assert.strictEqual(entry.args.username, "night.operator");

257 assert.strictEqual(entry.args.password, "[REDACTED]");

258 assert.strictEqual(entry.args.stationOrd, "[REDACTED]");

259 assert.strictEqual(authEntry.args.username, "[REDACTED]");

260 assert.strictEqual(authEntry.args.password, "[REDACTED]");

261 });

262 it("redacts stationOrd variants — camelCase, lowercase, and snake_case (#634)", async () => {

263 await withTelemetry("variant_tool", {

264 path: "/ok",

265 stationOrd: "foxs://admin:p1@h:4911",

266 stationord: "foxs://admin:p2@h:4911",

267 STATIONORD: "foxs://admin:p3@h:4911",