registry / @sapiom/mcp / 0.12.10
@sapiom/mcp@0.12.10
⚠ Under reviewLocal Sapiom developer MCP server (sapiom-dev) — the unmetered surface for building and operating on Sapiom; today it scaffolds, tests, deploys, and inspects orchestrations. Not the remote Sapiom capability MCP.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/auth.jsView file
1import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/auth.jsView on unpkg · L11Trigger-reachable chain: manifest.exports -> dist/auth-api.d.ts -> dist/auth.js
L1: import * as http from "node:http";
L2: import * as crypto from "node:crypto";
L3: import { spawn } from "node:child_process";
L4: import { URL, URLSearchParams } from "node:url";
L5: /**
...
L9: * - NEVER a visible console. The previous `execSync('start "" "<url>"')`
L10: * spawned cmd.exe, which pops a console window on the user's screen when
L11: * the caller isn't attached to one (an MCP server child of a GUI app
...
L16: * a cmd.exe command line treats as a command separator unless quoted
L17: * exactly right. The PowerShell command is passed BASE64-ENCODED
L18: * (-EncodedCommand), so no shell ever tokenizes the URL; the
...
L21: *
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical2 High3 Medium4 Low
CriticalReverse Shelldist/auth.js
CriticalTrigger Reachable Dangerous Capabilitydist/auth.js
CriticalPrevious Version Dangerous Deltadist/auth.js
HighChild Processdist/auth.js
HighSandbox Evasion Gated Capabilitydist/auth.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sapiom/mcp@0.12.10.
See all versions of @sapiom/mcp for other recorded verdicts.
- Review the evidence and your use of @sapiom/mcp@0.12.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.