registry / @stackwright-pro/mcp / 0.2.0-alpha.109

@stackwright-pro/mcp@0.2.0-alpha.109

MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 8 file(s), 667 KB of source, external domains: api.example.mil, ocsp.disa.mil

Source & flagged code

3 flagged

dist/server.jsView file

Lines 18-58javascript

18 // file that has been converted to a CommonJS file using a Babel-

19 // compatible transform (i.e. "__esModule" has not been set), then set

20 // "default" to the CommonJS "module.exports" for node compatibility.

21 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

22 mod

23));

25// src/server.ts

26var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");

27var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");

29// src/tools/data-explorer.ts

30var import_zod2 = require("zod");

31var import_cli_data_explorer = require("@stackwright-pro/cli-data-explorer");

33// src/coerce.ts

34var import_zod = require("zod");

35function jsonCoerce(schema) {

36 return import_zod.z.preprocess((v) => {

37 if (typeof v === "string") {

38 try {

39 return JSON.parse(v);

40 } catch {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server.jsView on unpkg · L38

41 return v;

42 }

43 }

44 return v;

45 }, schema);

46}

47function boolCoerce(schema) {

48 return import_zod.z.preprocess((v) => v === "true" ? true : v === "false" ? false : v, schema);

49}

50function numCoerce(schema) {

51 return import_zod.z.preprocess((v) => {

52 if (typeof v === "string" && v.trim() !== "") {

53 const n = Number(v);

54 if (!Number.isNaN(n)) return n;

55 }

56 return v;

57 }, schema);

58}

Lines 3946-3986javascript

3946 otterName: PHASE_TO_OTTER2[phase],

3947 phase,

3948 prompt,

3949 dependenciesSatisfied,

3950 missingDependencies

3951 }),

3952 isError: false

3953 };

3954 } catch (err) {

3955 const message = err

dist/tools/type-schemas.jsView file

Lines 6-46javascript

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

10var __copyProps = (to

Source & flagged code

3 flagged · loading source

dist/server.jsView file

38try { L39: return JSON.parse(v); L40: } catch { ... L126: ...excludePatterns !== void 0 && { excludePatterns }, L127: projectRoot: projectRoot ?? process.cwd() L128: }); ... L252: } L253: if (!specPath.startsWith("http://") && !specPath.startsWith("https://")) { L254: if (import_fs.default.existsSync(specPath)) { ... L867: var import_fs2 = require("fs"); L868: var import_child_process = require("child_process"); L869: var import_path2 = __toESM(require("path"));

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server.jsView on unpkg · L38

3966{ pattern: /\brequire\s*\(/, label: "require() call" }, L3967: { pattern: /\beval\s*\(/, label: "eval() call" }, L3968: { pattern: /^#!/m, label: "shebang" },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L3966

dist/tools/type-schemas.jsView file

26module.exports = __toCommonJS(type_schemas_exports); L27: var import_zod = require("zod"); L28: function buildTypeSchemaSummary() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/type-schemas.jsView on unpkg · L26

Findings

1 High3 Medium6 Low

HighObfuscated Payload Loaderdist/server.js

MediumDynamic Requiredist/tools/type-schemas.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/server.jsView file

Lines 18-58javascript

18 // file that has been converted to a CommonJS file using a Babel-

19 // compatible transform (i.e. "__esModule" has not been set), then set

20 // "default" to the CommonJS "module.exports" for node compatibility.

21 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

22 mod

23));

25// src/server.ts

26var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");

27var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");

29// src/tools/data-explorer.ts

30var import_zod2 = require("zod");

31var import_cli_data_explorer = require("@stackwright-pro/cli-data-explorer");

33// src/coerce.ts

34var import_zod = require("zod");

35function jsonCoerce(schema) {

36 return import_zod.z.preprocess((v) => {

37 if (typeof v === "string") {

38 try {

39 return JSON.parse(v);

40 } catch {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server.jsView on unpkg · L38

41 return v;

42 }

43 }

44 return v;

45 }, schema);

46}

47function boolCoerce(schema) {

48 return import_zod.z.preprocess((v) => v === "true" ? true : v === "false" ? false : v, schema);

49}

50function numCoerce(schema) {

51 return import_zod.z.preprocess((v) => {

52 if (typeof v === "string" && v.trim() !== "") {

53 const n = Number(v);

54 if (!Number.isNaN(n)) return n;

55 }

56 return v;

57 }, schema);

58}

Lines 3946-3986javascript

3946 otterName: PHASE_TO_OTTER2[phase],

3947 phase,

3948 prompt,

3949 dependenciesSatisfied,

3950 missingDependencies

3951 }),

3952 isError: false

3953 };

3954 } catch (err) {

3955 const message = err

dist/tools/type-schemas.jsView file

Lines 6-46javascript

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

10var __copyProps = (to