registry / @smart-coder-labs/nexusmind-mcp / 0.5.1

@smart-coder-labs/nexusmind-mcp@0.5.1

NexusMind MCP server for Claude Code and Cursor — team memory that persists across sessions

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 9 file(s), 189 KB of source, external domains: nexusmind-backend.fly.dev

Source & flagged code

4 flagged

dist/hooks/_helpers.jsView file

Lines 1-25javascript

1// _helpers.ts — shared utilities for NexusMind Codex CLI hook handlers.

2// Every hook is a short-lived Node process invoked by Codex with a JSON payload

3// on stdin. These helpers keep that contract consistent: parse stdin, resolve

4// env config, detect the project, hit the backend with a hard timeout, and

5// format/emit output the way Codex expects.

6import { spawnSync } from 'node:child_process';

7import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

8export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev';

9export const HEALTH_TIMEOUT_MS = 5000;

10export const FETCH_TIMEOUT_MS = 8000;

11export const STORE_TIMEOUT_MS = 10000;

12function envInt(name, fallback) {

13 const raw = process.env[name];

14 if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

15 return fallback;

16 const n = parseInt(raw, 10);

17 return Number.isFinite(n) && n > 0 ? n : fallback;

18}

19export const SESSION_PROJECT_LIMIT = envInt('NEXUSMIND_SESSION_PROJECT_LIMIT', 8);

20export const SESSION_RECENT_LIMIT = envInt('NEXUSMIND_SESSION_RECENT_LIMIT', 5);

21export const PROMPT_MEMORY_LIMIT = envInt('NEXUSMIND_PROMPT_MEMORY_LIMIT', 3);

22export const PROMPT_INJECT_MODE = (process.env.NEXUSMIND_PROMPT_INJECT ?? 'minimal').toLowerCase();

25/**

dist/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * nexusmind-mcp setup

4 * Interactively configures NexusMind for Claude Code, Cursor, or both.

5 *

6 * Usage:

7 * npx @smart-coder-labs/nexusmind-mcp setup

8 */

9import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';

10import { homedir } from 'node:os'

Source & flagged code

4 flagged · loading source

dist/hooks/_helpers.jsView file

5// format/emit output the way Codex expects. L6: import { spawnSync } from 'node:child_process'; L7: import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

5// format/emit output the way Codex expects. L6: import { spawnSync } from 'node:child_process'; L7: import { basename } from 'node:path'; L8: export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev'; L9: export const HEALTH_TIMEOUT_MS = 5000; ... L12: function envInt(name, fallback) { L13: const raw = process.env[name]; L14: if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

dist/setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @smart-coder-labs/nexusmind-mcp@0.5.0 matchedIdentity = npm:[redacted]:0.5.0 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/setup.jsView on unpkg

13import * as readline from 'node:readline/promises'; L14: import { stdin as input, stdout as output } from 'node:process'; L15: import { spawnSync } from 'node:child_process'; L16: // ── Paths ───────────────────────────────────────────────────────────────────── L17: const HOME = homedir(); L18: const CLAUDE_JSON_PATH = join(HOME, '.claude.json'); ... L30: function codexHomeDir() { L31: return process.env.CODEX_HOME || join(HOME, '.codex'); L32: } ... L53: try { L54: return JSON.parse(readFileSync(path, 'utf8')); L55: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup.jsView on unpkg · L13

Findings

4 High3 Medium5 Low

HighChild Processdist/hooks/_helpers.js

HighShell

HighSame File Env Network Executiondist/hooks/_helpers.js

HighPrevious Version Dangerous Deltadist/setup.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/setup.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/hooks/_helpers.jsView file

Lines 1-25javascript

1// _helpers.ts — shared utilities for NexusMind Codex CLI hook handlers.

2// Every hook is a short-lived Node process invoked by Codex with a JSON payload

3// on stdin. These helpers keep that contract consistent: parse stdin, resolve

4// env config, detect the project, hit the backend with a hard timeout, and

5// format/emit output the way Codex expects.

6import { spawnSync } from 'node:child_process';

7import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

8export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev';

9export const HEALTH_TIMEOUT_MS = 5000;

10export const FETCH_TIMEOUT_MS = 8000;

11export const STORE_TIMEOUT_MS = 10000;

12function envInt(name, fallback) {

13 const raw = process.env[name];

14 if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

15 return fallback;

16 const n = parseInt(raw, 10);

17 return Number.isFinite(n) && n > 0 ? n : fallback;

18}

19export const SESSION_PROJECT_LIMIT = envInt('NEXUSMIND_SESSION_PROJECT_LIMIT', 8);

20export const SESSION_RECENT_LIMIT = envInt('NEXUSMIND_SESSION_RECENT_LIMIT', 5);

21export const PROMPT_MEMORY_LIMIT = envInt('NEXUSMIND_PROMPT_MEMORY_LIMIT', 3);

22export const PROMPT_INJECT_MODE = (process.env.NEXUSMIND_PROMPT_INJECT ?? 'minimal').toLowerCase();

25/**

dist/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * nexusmind-mcp setup

4 * Interactively configures NexusMind for Claude Code, Cursor, or both.

5 *

6 * Usage:

7 * npx @smart-coder-labs/nexusmind-mcp setup

8 */

9import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';

10import { homedir } from 'node:os'