registry / @tenetvault/mcp-server / 0.9.7

@tenetvault/mcp-server@0.9.7

Local-first memory and rules layer for AI coding agents — MCP server and CLI.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 1.94 MB of source, external domains: 127.0.0.1, developer.mozilla.org, developers.cloudflare.com, hono.dev, nodejs.org, react.dev, www.w3.org

Source & flagged code

6 flagged

dist/index.jsView file

Lines 92-132javascript

92 "use strict";

93 }

94});

96// ../core/dist/feature-flags.js

97var init_feature_flags = __esm({

98 "../core/dist/feature-flags.js"() {

99 "use strict";

100 }

101});

102

103// ../core/dist/paths.js

104import { homedir } from "node:os";

105import { basename, dirname, isAbsolute, join as join2, relative, resolve, sep } from "node:path";

106function assertCanonicalVaultDbPath(path) {

107 const resolved = resolve(path);

108 if (basename(resolved) !== "vault.db") {

109 throw new Error(`Vault database filename must be 'vault.db' so the database and key slot share one unambiguous root (received: ${basename(resolved)}).`);

110 }

111 return resolved;

112}

113function resolveVaultRoot(env = process.env) {

114 const explicit = env.TENETVAULT_DB_PATH || env.TENETVAULT_PATH;

115 if (explicit)

116 return dirname(assertCanonicalVaultDbPath(explicit));

117 return join2(homedir(), ".tenetvault");

118}

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L112

119function resolveVaultDbPath(env = process.env) {

120 const explicit = env.TENETVAULT_DB_PATH || env.TENETVAULT_PATH;

121 return explicit ? assertCanonicalVaultDbPath(explicit) : join2(homedir(), ".tenetvault", "vault.db");

122}

123function resolveVaultPaths(env = process.env) {

124 const root = resolveVaultRoot(env);

125 return {

126 root,

127 db: resolveVaultDbPath(env),

128 backups: join2(root, "backups"),

129 exports: join2(root, "exports"),

130 evidence: join2(root, "evidence"),

131 token: join2(root, "daemon.token"),

132 growthPlanner: join2(root, "growth-planner.json"),

Lines 4202-4242javascript

4202 lastDaemonAvailable = false;

4203 setDaemonUnavailable();

4204 return false;

4205 }

4206 lastDaemonAvailable = true;

4207 setVaultStatus("security_error",

dist/cli.jsView file

Lines 77-117javascript

77 throw new TypeError(`id must satisfy ${idRegex}`);

78 }

79 fields.push(opts.id);

80 if (typeof opts.version !== "undefined") {

dist/local-api.jsView file

1import { createRequire as __tenetvaultCreateRequire } from "node:module"; const require = __tenetvaultCreateRequire(import.meta.url); L2: var __create = Object.create;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-api.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code