registry / @scorehub/mcp-server / 0.1.4

@scorehub/mcp-server@0.1.4

ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 19.4 KB of source, external domains: 127.0.0.1, mcp.scorehub.cn

Source & flagged code

2 flagged

dist/auth.jsView file

Lines 1-41javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loadTokens = loadTokens;

4exports.saveTokens = saveTokens;

5exports.clearTokens = clearTokens;

6exports.exchangeCodeForTokens = exchangeCodeForTokens;

7exports.refreshAccessToken = refreshAccessToken;

8exports.getValidAccessToken = getValidAccessToken;

9exports.generateCodeVerifier = generateCodeVerifier;

10exports.generateCodeChallenge = generateCodeChallenge;

11exports.generateState = generateState;

12exports.startCallbackServer = startCallbackServer;

13exports.openBrowser = openBrowser;

14exports.authorize = authorize;

15const node_https_1 = require("node:https");

16const node_http_1 = require("node:http");

17const node_fs_1 = require("node:fs");

18const node_path_1 = require("node:path");

19const node_os_1 = require("node:os");

20const node_http_2 = require("node:http");

21const node_crypto_1 = require("node:crypto");

22const node_child_process_1 = require("node:child_process");

23// ── Token Storage ────────────────────────────────────────────

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L21

24const SCOREHUB_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), ".scorehub");

25const TOKEN_FILE = (host) => (0, node_path_1.join)(SCOREHUB_DIR, host, "oauth.json");

26function ensureDir(filePath) {

27 const dir = (0, node_path_1.dirname)(filePath);

28 if (!(0, node_fs_1.existsSync)(dir)) {

29 (0, node_fs_1.mkdirSync)(dir, { recursive: true });

30 }

31}

32function loadTokens(host) {

33 const file = TOKEN_FILE(host);

34 if (!(0, node_fs_1.existsSync)(file))

35 return null;

36 try {

37 return JSON.parse((0, node_fs_1.readFileSync)(file, "utf-8"));

38 }

39 catch {

40 return null;

41 }

dist/index.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4/**

5 * ScoreHub MCP Server — Local MCP Proxy

6 *

7 * Architecture (mirrors @lessie/mcp-server):

8 * Agent (WorkBuddy/Claude) ──stdio── Local MCP Server ──Streamable HTTP── Remote MCP Server

Source & flagged code

2 flagged · loading source

dist/auth.jsView file

21const node_crypto_1 = require("node:crypto"); L22: const node_child_process_1 = require("node:child_process"); L23: // ── Token Storage ────────────────────────────────────────────

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code