registry / @tenetvault/mcp-server / 0.8.3

@tenetvault/mcp-server@0.8.3

Local-first memory and rules layer for AI coding agents — MCP server and CLI.

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 1.96 MB of source, external domains: 127.0.0.1, developer.mozilla.org, developers.cloudflare.com, hono.dev, nodejs.org, react.dev, www.w3.org

Source & flagged code

6 flagged

dist/index.jsView file

Lines 28-68javascript

28 // If the importer is in node compatibility mode or this is not an ESM

29 // file that has been converted to a CommonJS file using a Babel-

30 // compatible transform (i.e. "__esModule" has not been set), then set

31 // "default" to the CommonJS "module.exports" for node compatibility.

32 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

33 mod

34));

36// ../storage/dist/embeddings-onnx.js

37var embeddings_onnx_exports = {};

38__export(embeddings_onnx_exports, {

39 ONNX_DIMS: () => ONNX_DIMS,

40 OnnxProvider: () => OnnxProvider

41});

42import { join as join2 } from "node:path";

43import { homedir } from "node:os";

44var MODEL_ID, CACHE_DIR, ONNX_DIMS, OnnxProvider;

45var init_embeddings_onnx = __esm({

46 "../storage/dist/embeddings-onnx.js"() {

47 "use strict";

48 MODEL_ID = "Xenova/paraphrase-multilingual-MiniLM-L12-v2";

49 CACHE_DIR = join2(homedir(), ".tenetvault", "models");

50 ONNX_DIMS = 384;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L48

51 OnnxProvider = class {

52 name = "onnx";

53 dims = ONNX_DIMS;

54 pipe = null;

55 warmupPromise = null;

56 async warmup() {

57 if (this.pipe)

58 return;

59 if (this.warmupPromise)

60 return this.warmupPromise;

61 this.warmupPromise = this.doWarmup();

62 return this.warmupPromise;

63 }

64 async doWarmup() {

65 const { pipeline } = await import("@huggingface/transformers");

66 this.pipe = await pipeline("feature-extraction", MODEL_ID, {

67 cache_dir: CACHE_DIR,

68 dtype: "fp32"

Lines 8281-8321javascript

8281 "rules",

8282 "rule",

8283 "start",

8284 "stop",

8285 "status",

8286 "open",

8287 "daemon",

8288

dist/local-api.jsView file

1import { createRequire as __tenetvaultCreateRequire } from "node:module"; const require = __tenetvaultCreateRequire(import.meta.url); L2: var __create = Object.create;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-api.jsView on unpkg · L1

dist/cli.jsView file

10539import { homedir as homedir9 } from "node:os"; L10540: import { spawn, execSync as execSync2 } from "node:child_process"; L10541: import { createRequire as _createRequire } from "node:module"; L10542: import { request } from "node:http"; L10543: var DEFAULT_API_PORT = 7842; ... L10546: function getServicePaths() { L10547: const vaultDir = process.env.TENETVAULT_PATH ? dirname7(process.env.TENETVAULT_PATH) : join13(homedir9(), ".tenetvault"); L10548: return {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L10539

9215try { L9216: const result = execSync("npx -y -p @tenetvault/mcp-server@latest tenetvault-mcp --health-check", { L9217: timeout: 1e4,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L9215

101} else if (Buffer.isBuffer(opts.params[k])) { L102: opts.params[k] = opts.params[k].toString("base64").split("=")[0]; L103: } ... L204: var vars = process.config && process.config.variables || {}; L205: var prebuildsOnly = !!process.env.PREBUILDS_ONLY; L206: var abi = process.versions.modules; ... L219: try { L220: var name = runtimeRequire(path.join(dir, "package.json")).name.toUpperCase().replace(/-/g, "_"); L221: if (process.env[name + "_PREBUILD"]) dir = process.env[name + "_PREBUILD"]; ... L384: var gypBuild = require_node_gyp_build2(); L385: var { hash: bindingsHash } = gypBuild(__dirname); L386: var generateSalt2 = promisify(randomBytes4);

Medium

Source & flagged code

6 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code