registry / @smart-coder-labs/nexusmind-mcp / 0.6.2

@smart-coder-labs/nexusmind-mcp@0.6.2

NexusMind MCP server for Claude Code and Cursor — team memory that persists across sessions

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 10 file(s), 205 KB of source, external domains: github.com, nexusmind-backend.fly.dev

Source & flagged code

4 flagged

dist/hooks/_helpers.jsView file

Lines 1-25javascript

1// _helpers.ts — shared utilities for NexusMind Codex CLI hook handlers.

2// Every hook is a short-lived Node process invoked by Codex with a JSON payload

3// on stdin. These helpers keep that contract consistent: parse stdin, resolve

4// env config, detect the project, hit the backend with a hard timeout, and

5// format/emit output the way Codex expects.

6import { spawnSync } from 'node:child_process';

7import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

8import { readFile } from 'node:fs/promises';

9export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev';

10export const HEALTH_TIMEOUT_MS = 5000;

11export const FETCH_TIMEOUT_MS = 8000;

12export const STORE_TIMEOUT_MS = 10000;

13function envInt(name, fallback) {

14 const raw = process.env[name];

15 if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

16 return fallback;

17 const n = parseInt(raw, 10);

18 return Number.isFinite(n) && n > 0 ? n : fallback;

19}

20export const SESSION_PROJECT_LIMIT = envInt('NEXUSMIND_SESSION_PROJECT_LIMIT', 8);

21export const SESSION_RECENT_LIMIT = envInt('NEXUSMIND_SESSION_RECENT_LIMIT', 5);

22export const PROMPT_MEMORY_LIMIT = envInt('NEXUSMIND_PROMPT_MEMORY_LIMIT', 3);

23export const PROMPT_INJECT_MODE = (process.env.NEXUSMIND_PROMPT_INJECT ?? 'minimal').toLowerCase();

dist/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * nexusmind-mcp setup

4 * Interactively configures NexusMind for Claude Code, Cursor, or both.

5 *

6 * Usage:

7 * npx @smart-coder-labs/nexusmind-mcp setup

8 */

9import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';

10import { homedir } from 'node:os'

Source & flagged code

4 flagged · loading source

dist/hooks/_helpers.jsView file

5// format/emit output the way Codex expects. L6: import { spawnSync } from 'node:child_process'; L7: import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

5// format/emit output the way Codex expects. L6: import { spawnSync } from 'node:child_process'; L7: import { basename } from 'node:path'; L8: import { readFile } from 'node:fs/promises'; L9: export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev'; L10: export const HEALTH_TIMEOUT_MS = 5000; ... L13: function envInt(name, fallback) { L14: const raw = process.env[name]; L15: if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

dist/setup.jsView file

136return; L137: const res = spawnSync('setx', [name, value], { stdio: 'ignore', shell: true }); L138: if (!res.error && res.status === 0) {

High

Shell

Package source references shell execution.

dist/setup.jsView on unpkg · L136

13import * as readline from 'node:readline/promises'; L14: import { stdin as input, stdout as output } from 'node:process'; L15: import { spawnSync } from 'node:child_process'; L16: // ── Paths ───────────────────────────────────────────────────────────────────── L17: const HOME = homedir(); L18: const CLAUDE_JSON_PATH = join(HOME, '.claude.json'); ... L32: function codexHomeDir() { L33: return process.env.CODEX_HOME || join(HOME, '.codex'); L34: } ... L55: try { L56: return JSON.parse(readFileSync(path, 'utf8')); L57: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup.jsView on unpkg · L13

Findings

3 High3 Medium6 Low

HighChild Processdist/hooks/_helpers.js

HighShelldist/setup.js

HighSame File Env Network Executiondist/hooks/_helpers.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/setup.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/hooks/_helpers.jsView file

Lines 1-25javascript

1// _helpers.ts — shared utilities for NexusMind Codex CLI hook handlers.

2// Every hook is a short-lived Node process invoked by Codex with a JSON payload

3// on stdin. These helpers keep that contract consistent: parse stdin, resolve

4// env config, detect the project, hit the backend with a hard timeout, and

5// format/emit output the way Codex expects.

6import { spawnSync } from 'node:child_process';

7import { basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/hooks/_helpers.jsView on unpkg · L5

8import { readFile } from 'node:fs/promises';

9export const DEFAULT_BASE_URL = 'https://nexusmind-backend.fly.dev';

10export const HEALTH_TIMEOUT_MS = 5000;

11export const FETCH_TIMEOUT_MS = 8000;

12export const STORE_TIMEOUT_MS = 10000;

13function envInt(name, fallback) {

14 const raw = process.env[name];

15 if (!raw)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/_helpers.jsView on unpkg · L5

16 return fallback;

17 const n = parseInt(raw, 10);

18 return Number.isFinite(n) && n > 0 ? n : fallback;

19}

20export const SESSION_PROJECT_LIMIT = envInt('NEXUSMIND_SESSION_PROJECT_LIMIT', 8);

21export const SESSION_RECENT_LIMIT = envInt('NEXUSMIND_SESSION_RECENT_LIMIT', 5);

22export const PROMPT_MEMORY_LIMIT = envInt('NEXUSMIND_PROMPT_MEMORY_LIMIT', 3);

23export const PROMPT_INJECT_MODE = (process.env.NEXUSMIND_PROMPT_INJECT ?? 'minimal').toLowerCase();

dist/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * nexusmind-mcp setup

4 * Interactively configures NexusMind for Claude Code, Cursor, or both.

5 *

6 * Usage:

7 * npx @smart-coder-labs/nexusmind-mcp setup

8 */

9import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';

10import { homedir } from 'node:os'

Lines 116-156javascript

116 lines.push(`export NEXUSMIND_BASE_URL="${baseUrl}"`);

117 }

118 if (lines.length) {

119 writeFileSync(rc, text + `\n# NexusMind\n${lines.join('\n')}\n`);

120 success(`Env vars → ${rc}`);

121 }

122 }

123}

124// Windows persistent env vars via setx, which writes HKCU\Environment (User

125// scope) so every future process inherits them. Without this, setup wrote only

126// to shell rc files that don't exist on Windows, leaving NEXUSMIND_BASE_URL

127// unset — so clients failed with "Missing environment variables:

128// NEXUSMIND_BASE_URL" when expanding the ${...} placeholders in their MCP

129// config. setx only affects processes started AFTER it runs, so the user must

130// restart their client (already the documented post-setup step); we also mirror

131// the values into process.env so any same-run check sees them. Values here (an

132// API key + a URL) are far under setx's ~1024-char limit.

133function writeWindowsEnv(apiKey, baseUrl) {

134 const setVar = (name, value) => {

135 if (!value)

136 return;

137 const res = spawnSync('setx', [name, value], { stdio: 'ignore', shell: true });

138 if (!res.error && res.status === 0) {

High

Shell

Package source references shell execution.

dist/setup.jsView on unpkg · L136

139 process.env[name] = value;

140 success(`Env var ${name} → Windows user environment`);

141 }

142 else {

143 warn(`Could not set ${name} automatically — run this yourself: setx ${name} "${value}"`);

144 }

145 };

146 setVar('NEXUSMIND_API_KEY', apiKey);

147 setVar('NEXUSMIND_BASE_URL', baseUrl);

148}

149// ── Install helpers ───────────────────────────────────────────────────────────

150// The Claude plugin is the canonical registration path for Claude Code — it owns

151// the MCP server entry and hooks. Setup no longer writes a user-level MCP server

152// registration (~/.claude.json or ~/.claude/settings.json) for Claude Code; it only

153// detects the plugin and guides the user to install it if missing.

154function isNexusmindPluginInstalled() {

155 const data = readJson(INSTALLED_PLUGINS_JSON);

156 if (existsSync(INSTALLED_PLUGINS_JSON) && !('plugins' in data)) {