registry  /  @sensegrep/mcp  /  1.11.0

@sensegrep/mcp@1.11.0

MCP server exposing sensegrep's semantic + structural code search to AI agents, delivering smaller, more relevant context.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
DynamicRequireEnvironmentVars
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 50.4 KB of source

Source & flagged code

2 flagged · loading source
dist/server.jsView file
33package = @sensegrep/mcp; repositoryIdentity = sensegrep; dependency = @sensegrep/core L33: if (!corePromise) { L34: corePromise = import("@sensegrep/core").catch(async (error) => { L35: const fallbackUrl = pathToFileURL(path.join(__dirname, "..", "..", "core", "dist", "index.js")).href;
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/server.jsView on unpkg · L33
33if (!corePromise) { L34: corePromise = import("@sensegrep/core").catch(async (error) => { L35: const fallbackUrl = pathToFileURL(path.join(__dirname, "..", "..", "core", "dist", "index.js")).href;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L33

Findings

1 High3 Medium2 Low
HighCopied Package Dependency Bridgedist/server.js
MediumDynamic Requiredist/server.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present