registry / @suveren/gateway / 0.3.3

@suveren/gateway@0.3.3

Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 567 KB of source, external domains: 0.0.0.0, 127.0.0.1, api.github.com, api.groq.com, api.openai.com, api.together.xyz, ghcr.io, openrouter.ai, reactjs.org, registry.npmjs.org, www.humanagencyprotocol.org, www.suveren.ai, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 1-31json

2 "name": "@suveren/gateway",

3 "version": "0.3.3",

4 "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",

5 "type": "module",

6 "main": "server.js",

7 "bin": {

8 "suveren-gateway": "bin/suveren-gateway.js"

9 },

10 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L10

11 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 },

13 "files": [

14 "bin",

15 "dist",

16 "scripts",

17 "content",

18 "profiles",

19 "server.js",

20 "README.md"

21 ],

22 "engines": {

23 "node": ">=20"

24 },

25 "dependencies": {

26 "@hap/core": "npm:@humanagencyp/hap-core@^0.6.1",

27 "@hpke/core": "^1.9.0",

28 "express": "^4.18.0",

29 "http-proxy-middleware": "^3.0.0",

30 "@modelcontextprotocol/sdk": "^1.12.1",

31 "zod": "^3.22.0"

bin/suveren-gateway.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * suveren-gateway CLI — wraps `node server.js` with start/stop/status/logs.

4 *

5 * Foreground by default (Ctrl+C stops). Pass --detach for a daemonized

6 * run that writes a PID file and a log file under ~/.suveren/.

7 *

8 * Cross-platform: macOS, Linux, Windows. Uses os.homedir() everywhere

9 * (no $HOME dependency). Process-existence checks via process.kill(pid, 0)

10 * which Node implements consistently across platforms.

11 */

dist/mcp-server/http.mjsView file

Lines 2047-2087javascript

2047 }

2048 running = /* @__PURE__ */ new Map();

2049 onToolsChanged = null;

2050 /**

2051 * Register a callback invoked when the tool set changes

2052 * (integration started, stopped, or crashed).

2053 */

2054 setOnToolsChanged(cb) {

dist/ui/fonts/Inter-Medium.woff2View file

•path = dist/ui/fonts/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/fonts/Inter-Medium.woff2View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/suveren-gateway.jsView file

12L13: import { spawn } from 'node:child_process'; L14: import { existsSync, mkdirSync, openSync, readFileSync, writeFileSync, unlinkSync, statSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/suveren-gateway.jsView on unpkg · L12

187// Stream new lines as they arrive. L188: const proc = spawn(platform() === 'win32' ? 'powershell' : 'tail', L189: platform() === 'win32'

High

Shell

Package source references shell execution.

bin/suveren-gateway.jsView on unpkg · L187

74const out = openSync(LOG_FILE, 'a'); L75: const child = spawn(process.execPath, [SERVER_ENTRY], { L76: detached: true, L77: stdio: ['ignore', out, out], L78: env: process.env, L79: }); ... L83: console.log(``); L84: console.log(` → Open in your browser: http://localhost:${SUVEREN_PORT}`); L85: console.log(``);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/suveren-gateway.jsView on unpkg · L74

dist/mcp-server/http.mjsView file

2067try { L2068: execSync(`npm install --no-fund --no-audit ${npmPackage}`, { L2069: cwd: INTEGRATIONS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp-server/http.mjsView on unpkg · L2067

dist/ui/fonts/Inter-Medium.woff2View file

•path = dist/ui/fonts/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/fonts/Inter-Medium.woff2View on unpkg

Findings

1 Critical6 High4 Medium4 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/suveren-gateway.js

HighShellbin/suveren-gateway.js

HighSame File Env Network Executionbin/suveren-gateway.js

HighRuntime Package Installdist/mcp-server/http.mjs

HighShips High Entropy Blobdist/ui/fonts/Inter-Medium.woff2

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 1-31json

2 "name": "@suveren/gateway",

3 "version": "0.3.3",

4 "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",

5 "type": "module",

6 "main": "server.js",

7 "bin": {

8 "suveren-gateway": "bin/suveren-gateway.js"

9 },

10 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L10

11 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 },

13 "files": [

14 "bin",

15 "dist",

16 "scripts",

17 "content",

18 "profiles",

19 "server.js",

20 "README.md"

21 ],

22 "engines": {

23 "node": ">=20"

24 },

25 "dependencies": {

26 "@hap/core": "npm:@humanagencyp/hap-core@^0.6.1",

27 "@hpke/core": "^1.9.0",

28 "express": "^4.18.0",

29 "http-proxy-middleware": "^3.0.0",

30 "@modelcontextprotocol/sdk": "^1.12.1",

31 "zod": "^3.22.0"

bin/suveren-gateway.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * suveren-gateway CLI — wraps `node server.js` with start/stop/status/logs.

4 *

5 * Foreground by default (Ctrl+C stops). Pass --detach for a daemonized

6 * run that writes a PID file and a log file under ~/.suveren/.

7 *

8 * Cross-platform: macOS, Linux, Windows. Uses os.homedir() everywhere

9 * (no $HOME dependency). Process-existence checks via process.kill(pid, 0)

10 * which Node implements consistently across platforms.

11 */

dist/mcp-server/http.mjsView file

Lines 2047-2087javascript

2047 }

2048 running = /* @__PURE__ */ new Map();

2049 onToolsChanged = null;

2050 /**

2051 * Register a callback invoked when the tool set changes

2052 * (integration started, stopped, or crashed).

2053 */

2054 setOnToolsChanged(cb) {

dist/ui/fonts/Inter-Medium.woff2View file

•path = dist/ui/fonts/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/fonts/Inter-Medium.woff2View on unpkg

Lines 54-94javascript

54 printHelp(); break;

55 default:

56 console.error(`Unknown command: ${cmd}\n`);

57 printHelp();

58 process.exit(2);

59}

61// ─── Implementations ────────────────────────────────────────────────────

63async function start(args) {

64 const detach = args.includes('--detach') || args.includes('-d');

66 if (await isAlreadyRunning()) {

67 console.error(`suveren-gateway is already running (pid ${readPid()}). Use \`suveren-gateway stop\` first or \`suveren-gateway restart\`.`);

68 process.exit(1);

69 }

71 ensureDataDir();

73 if (detach) {

74 const out = openSync(LOG_FILE, 'a');

75 const child = spawn(process.execPath, [SERVER_ENTRY], {

76 detached: true,

77 stdio: ['ignore', out, out],

78 env: process.env,

79 });

80 writeFileSync(PID_FILE, String(child.pid), 'utf8');

81 child.unref();

82 console.log(`suveren-gateway started (pid ${child.pid})`);

83 console.log(``);

84 console.log(` → Open in your browser: http://localhost:${SUVEREN_PORT}`);

85 console.log(``);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/suveren-gateway.jsView on unpkg · L74

86 console.log(` Logs: ${LOG_FILE}`);

87 console.log(` Stop: suveren-gateway stop`);

88 } else {

89 // Foreground — replace this CLI process with server.js's stdio.

90 console.log(`Starting suveren-gateway… open http://localhost:${SUVEREN_PORT} once "up" appears below. Ctrl+C to stop.`);

91 console.log(``);

92 const child = spawn(process.execPath, [SERVER_ENTRY], {

93 stdio: 'inherit',

94 env: process.env,

Lines 167-207javascript

167 } catch (err) {

168 console.log(`suveren-gateway: pid ${pid} alive but /health unreachable (${err.message})`);

169 process.exit(2);

170 }

171}

172

173async function restart() {

174 if (readPid() && isPidAlive(readPid())) {

175 await stop();

176 }

177 await start(['--detach']);

178}

179

180async function logs(args) {

181 if (!existsSync(LOG_FILE)) {

182 console.error(`No log file at ${LOG_FILE}.`);

183 console.error(`Logs are only written when running with --detach. In foreground mode the gateway prints to the terminal.`);

184 process.exit(1);

185 }

186 if (args.includes('--tail') || args.includes('-f')) {

187 // Stream new lines as they arrive.

188 const proc = spawn(platform() === 'win32' ? 'powershell' : 'tail',

189 platform() === 'win32'

High

Shell

Package source references shell execution.

bin/suveren-gateway.jsView on unpkg · L187

190 ? ['-Command', `Get-Content -Path '${LOG_FILE}' -Wait`]

191 : ['-f', LOG_FILE],

192 { stdio: 'inherit' });

193 process.on('SIGINT', () => proc.kill());

194 } else {

195 // Print entire log.

196 process.stdout.write(readFileSync(LOG_FILE, 'utf8'));

197 }

198}

199

200// ─── Helpers ────────────────────────────────────────────────────────────

201

202function ensureDataDir() {

203 if (!existsSync(DATA_DIR)) mkdirSync(DATA_DIR, { recursive: true });

204}

205

206function readPid() {

207 if (!existsSync(PID_FILE)) return null;