registry / @trustbaseai/collab-mcp / 0.3.0

@trustbaseai/collab-mcp@0.3.0

Multi-AI collaboration MCP server - core communication layer

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 128 KB of source, external domains: 127.0.0.1, www.launchd.info

Source & flagged code

5 flagged

src/cli-install.jsView file

Lines 94-134javascript

94 } else {

95 try {

96 const u = await prompt('Admin username [admin]: ');

97 username = (u || 'admin').trim();

98 password = await prompt('Admin password (empty = random): ');

99 } catch (_) {

100 // readline blew up (rare); fall back to random

101 password = crypto.randomBytes(16).toString('base64url');

102 console.log('✓ Interactive prompt failed → generated random admin password');

103 }

104 if (!password) {

105 password = crypto.randomBytes(16).toString('base64url');

106 console.log('✓ Generated random admin password');

107 }

108 }

109

110 try {

111 const hash = await auth.hashPassword(password);

112 db.createUser({ username, password_hash: hash, role: 'admin' });

113 console.log('✓ Created admin user: ' + username);

114 console.log(' password: ' + password);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

115 console.log(' (change with: collab-mcp user passwd ' + username + ')');

116 } catch (e) {

117 console.error('✗ Failed to create admin user:', e.message);

118 db.close();

119 return 1;

120 }

121 }

122

123 // 5. Admin API key (DB-backed, replaces Phase 1 configStore.api_keys.admin)

124 const existingAdminKeys = db.listApiKeys().filter((k) => k.name === 'admin' && !k.revoked);

125 if (existingAdminKeys.length > 0) {

126 console.log('• admin API key already exists (use `collab-mcp keys list` to view)');

127 } else {

128 const id = 'cmcp_' + crypto.randomBytes(16).toString('hex');

129 const secret = crypto.randomBytes(32).toString('base64url');

130 const hash = await auth.hashPassword(secret);

131 try {

132 db.createApiKey({

133 id,

134 name: 'admin',

src/service-windows.jsView file

Lines 1-32javascript

1'use strict';

3/**

4 * service-windows.js - Windows service installer

5 *

6 * Strategy:

7 * 1. Write a .bat wrapper at ~/.collab-mcp/bin/service-start.bat

8 * 2. Try sc.exe create (requires admin). If that fails, fall back to a

9 * Logon-triggered Scheduled Task (no admin required).

10 * 3. uninstall() removes both, in case the user switched modes.

11 */

src/cli-user.jsView file

Lines 43-113javascript

43 console.error('Usage: collab-mcp user create <username> [role]');

44 return 1;

45 }

46 const role = args[1] || 'user';

47 if (role !== 'admin' && role

Source & flagged code

5 flagged · loading source

src/cli-install.jsView file

114patternName = generic_password severity = medium line = 114 matchedText = console....rd);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

src/service-windows.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trustbaseai/collab-mcp@0.2.11 matchedIdentity = npm:QHRydXN0YmFzZWFpL2NvbGxhYi1tY3A:0.2.11 similarity = 0.826 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/service-windows.jsView on unpkg

12L13: const { execFileSync } = require('child_process'); L14: const fs = require('fs'); ... L30: fs.mkdirSync(wrapperDir(), { recursive: true }); L31: // bin/collab-mcp.js sits next to package.json in the install root; we L32: // resolve via the package root so the wrapper works regardless of cwd. L33: const pkgRoot = path.resolve(__dirname, '..'); L34: const scriptPath = path.join(pkgRoot, 'bin', 'collab-mcp.js'); ... L65: function installViaScheduledTask(wbat) { L66: // Use schtasks command-line flags instead of XML file to avoid encoding issues. L67: // /sc ONLOGON = trigger on user logon

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service-windows.jsView on unpkg · L12

src/cli-user.jsView file

63patternName = generic_password severity = medium line = 63 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in src/cli-user.js

src/cli-user.jsView on unpkg · L63

93patternName = generic_password severity = medium line = 93 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in src/cli-user.js

src/cli-user.jsView on unpkg · L93

Findings

1 High6 Medium4 Low

HighPrevious Version Dangerous Deltasrc/service-windows.js

MediumSecret Patternsrc/cli-install.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/service-windows.js

MediumSecret Patternsrc/cli-user.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/cli-install.jsView file

Lines 94-134javascript

94 } else {

95 try {

96 const u = await prompt('Admin username [admin]: ');

97 username = (u || 'admin').trim();

98 password = await prompt('Admin password (empty = random): ');

99 } catch (_) {

100 // readline blew up (rare); fall back to random

101 password = crypto.randomBytes(16).toString('base64url');

102 console.log('✓ Interactive prompt failed → generated random admin password');

103 }

104 if (!password) {

105 password = crypto.randomBytes(16).toString('base64url');

106 console.log('✓ Generated random admin password');

107 }

108 }

109

110 try {

111 const hash = await auth.hashPassword(password);

112 db.createUser({ username, password_hash: hash, role: 'admin' });

113 console.log('✓ Created admin user: ' + username);

114 console.log(' password: ' + password);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli-install.jsView on unpkg · L114

115 console.log(' (change with: collab-mcp user passwd ' + username + ')');

116 } catch (e) {

117 console.error('✗ Failed to create admin user:', e.message);

118 db.close();

119 return 1;

120 }

121 }

122

123 // 5. Admin API key (DB-backed, replaces Phase 1 configStore.api_keys.admin)

124 const existingAdminKeys = db.listApiKeys().filter((k) => k.name === 'admin' && !k.revoked);

125 if (existingAdminKeys.length > 0) {

126 console.log('• admin API key already exists (use `collab-mcp keys list` to view)');

127 } else {

128 const id = 'cmcp_' + crypto.randomBytes(16).toString('hex');

129 const secret = crypto.randomBytes(32).toString('base64url');

130 const hash = await auth.hashPassword(secret);

131 try {

132 db.createApiKey({

133 id,

134 name: 'admin',

src/service-windows.jsView file

Lines 1-32javascript

1'use strict';

3/**

4 * service-windows.js - Windows service installer

5 *

6 * Strategy:

7 * 1. Write a .bat wrapper at ~/.collab-mcp/bin/service-start.bat

8 * 2. Try sc.exe create (requires admin). If that fails, fall back to a

9 * Logon-triggered Scheduled Task (no admin required).

10 * 3. uninstall() removes both, in case the user switched modes.

11 */

src/cli-user.jsView file

Lines 43-113javascript

43 console.error('Usage: collab-mcp user create <username> [role]');

44 return 1;

45 }

46 const role = args[1] || 'user';

47 if (role !== 'admin' && role