registry / @scorehub/mcp-server / 0.2.0

@scorehub/mcp-server@0.2.0

ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 20.6 KB of source, external domains: 127.0.0.1, mcp.scorehub.cn

Source & flagged code

3 flagged

dist/auth.jsView file

Lines 1-41javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loadTokens = loadTokens;

4exports.saveTokens = saveTokens;

5exports.clearTokens = clearTokens;

6exports.exchangeCodeForTokens = exchangeCodeForTokens;

7exports.refreshAccessToken = refreshAccessToken;

8exports.getValidAccessToken = getValidAccessToken;

9exports.generateCodeVerifier = generateCodeVerifier;

10exports.generateCodeChallenge = generateCodeChallenge;

11exports.generateState = generateState;

12exports.startCallbackServer = startCallbackServer;

13exports.openBrowser = openBrowser;

14exports.authorize = authorize;

15const node_https_1 = require("node:https");

16const node_http_1 = require("node:http");

17const node_fs_1 = require("node:fs");

18const node_path_1 = require("node:path");

19const node_os_1 = require("node:os");

20const node_http_2 = require("node:http");

21const node_crypto_1 = require("node:crypto");

22const node_child_process_1 = require("node:child_process");

23// ── Token Storage ────────────────────────────────────────────

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L21

24const SCOREHUB_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), ".scorehub");

25const TOKEN_FILE = (host) => (0, node_path_1.join)(SCOREHUB_DIR, host, "oauth.json");

26function ensureDir(filePath) {

27 const dir = (0, node_path_1.dirname)(filePath);

28 if (!(0, node_fs_1.existsSync)(dir)) {

29 (0, node_fs_1.mkdirSync)(dir, { recursive: true });

30 }

31}

32function loadTokens(host) {

33 const file = TOKEN_FILE(host);

34 if (!(0, node_fs_1.existsSync)(file))

35 return null;

36 try {

37 return JSON.parse((0, node_fs_1.readFileSync)(file, "utf-8"));

38 }

39 catch {

40 return null;

41 }

dist/index.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4/**

5 * ScoreHub MCP Server — Local MCP Proxy

6 *

7 * Architecture (mirrors @lessie/mcp-server):

8 * Agent (WorkBuddy/Claude) ──stdio── Local MCP Server ──Streamable HTTP── Remote MCP Server

Source & flagged code

3 flagged · loading source

dist/auth.jsView file

21const node_crypto_1 = require("node:crypto"); L22: const node_child_process_1 = require("node:child_process"); L23: // ── Token Storage ────────────────────────────────────────────

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code