registry  /  @telegraphprotocol/telegraph-protocol-mcp  /  1.0.0

@telegraphprotocol/telegraph-protocol-mcp@1.0.0

MCP server exposing Telegraph Protocol AI miners (weather, deepfake detection, LLMs, AI-text detection, signals) as tools with automatic x402 USDC micropayments

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot
Behavioral surface
Source
EnvironmentVarsNetwork
Supply chain
HighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 12 file(s), 30.3 KB of source

Source & flagged code

2 flagged · loading source
dist/x402.jsView file
10package = @telegraphprotocol/telegraph-protocol-mcp; repositoryIdentity = telegraph-mcp; dependency = @scure/base L10: const solanaKit = await import("@solana/kit"); L11: const scure = await import("@scure/base"); L12: svmModules = {
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/x402.jsView on unpkg · L10
dist/config.jsView file
•matchType = package_source_clone_identity_mismatch matchedPackage = telegraph-protocol-mcp@1.0.0 matchedPath = dist/client.js matchedIdentity = npm:dGVsZWdyYXBoLXByb3RvY29sLW1jcA:1.0.0 similarity = 1.000 shingleOverlap = 11 summary = source files closely matched a different published package identity
High
Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

dist/config.jsView on unpkg

Findings

2 High3 Medium3 Low
HighCopied Package Dependency Bridgedist/x402.js
HighPackage Source Clone Identity Mismatchdist/config.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings