registry / @vibekiln/cutline-mcp-cli-staging
@vibekiln/cutline-mcp-cli-staging
CLI and MCP servers for Cutline, including SlopBurn: a product quality engineering roguelike RPG for vibecoding workflows.
This report shows the evidence for @vibekiln/cutline-mcp-cli-staging@0.8.2. 0 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no confirmed credential exfiltration or install-time attack, but its opt-in HTTP bridge has no authentication and binds to all interfaces by default. That exposes local MCP operations, including a shell-based test execution path, to any caller who can reach the port.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user starts `cutline-mcp serve <server> --http`; a remote caller then sends requests to the bridge.
Impact
A reachable unauthenticated caller may invoke local MCP operations and trigger configured test commands with the server process’s environment and workspace access.
Mechanism
The bridge defaults to binding 0.0.0.0:8080 and forwards JSON-RPC messages to its child server without checking caller authentication. SlopBurn verification can automatically execute generated tests using a shell command and inherited environment.
AI rationale
The package has no confirmed credential exfiltration or install-time attack, but its opt-in HTTP bridge has no authentication and binds to all interfaces by default. That exposes local MCP operations, including a shell-based test execution path, to any caller who can reach the port.
Evidence
dist/commands/serve.jsdist/servers/slopburn-server.jsdist/index.js
Network endpoints1
0.0.0.0:8080 (default HTTP bridge bind)
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- When HTTP bridge mode is enabled, it binds to 0.0.0.0:8080 by default and forwards JSON-RPC requests to the MCP server without an authentication check.
- The SlopBurn verification action enables generated-test execution by default, and its helper runs a shell command with the full process environment.
- The bridge requires the explicit --http option; no install-time or import-time attack behavior was identified.
- The inspected credential flow sends refresh tokens to Google Secure Token and Cutline ID tokens to Cutline endpoints.
Evidence against
- HTTP bridge mode is explicitly opt-in through the serve command’s --http option.
- The shell execution is part of SlopBurn’s local test-verification workflow and uses its configured test command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetry
Source & flagged code
8 flaggeddist/commands/serve.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @vibekiln/cutline-mcp-cli-staging@0.5.4
matchedIdentity = npm:[redacted]:0.5.4
similarity = 0.931
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/commands/serve.jsView on unpkg1import { execFileSync, spawn } from 'node:child_process';
L2: import { createServer } from 'node:http';
High
Child Process
Package source references child process execution.
dist/commands/serve.jsView on unpkg · L11Cross-file remote execution chain: dist/commands/serve.js spawns dist/servers/cutline-server.js; helper contains network access plus dynamic code execution.
L1: import { execFileSync, spawn } from 'node:child_process';
L2: import { createServer } from 'node:http';
L3: import { resolve, dirname } from 'node:path';
...
L5: import { existsSync } from 'node:fs';
L6: const __dirname = dirname(fileURLToPath(import.meta.url));
L7: export const SERVER_MAP = {
...
L51: try {
L52: const text = Buffer.concat(chunks).toString('utf8');
L53: resolveBody(text ? JSON.parse(text) : {});
...
L67: });
L68: res.end(payload);
L69: }
Findings
1 Critical6 High2 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/commands/serve.js
HighChild Processdist/commands/serve.js
HighShelldist/servers/slopburn-server.js
HighCredential Exfiltrationdist/servers/chunk-NQOTQA5Z.js
HighCredential Redirect Persistencedist/commands/init.js
HighCross File Remote Execution Contextdist/commands/serve.js
HighSemantic Analysis Limiteddist/servers/chunk-NQOTQA5Z.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/servers/slopburn-server.js
Low
Affected versions and remediation
This report applies to @vibekiln/cutline-mcp-cli-staging@0.8.2.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @vibekiln/cutline-mcp-cli-staging@0.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.