registry / @vizejs/musea-mcp-server / 0.273.0

@vizejs/musea-mcp-server@0.273.0

MCP server for building Vue.js design systems - component analysis, documentation, variant generation, and design tokens

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 64.9 KB of source

Source & flagged code

1 flagged

dist/src-DMeHW2z2.mjsView file

Lines 1-32javascript

1import { createRequire } from "node:module";

2import { Server } from "@modelcontextprotocol/sdk/server/index.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import { CallToolRequestSchema, ErrorCode, ListResourcesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";

5import fs from "node:fs";

6import path from "node:path";

7//#region src/native.ts

8let native = null;

9function loadNative() {

10 if (native) return native;

11 const require = createRequire(import.meta.url);

12 try {

13 native = require("@vizejs/native");

14 return native;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src-DMeHW2z2.mjsView on unpkg · L12

15 } catch (e) {

16 throw new Error(`Failed to load @vizejs/native. Make sure it's installed: ${String(e)}`);

17 }

18}

19//#endregion

20//#region src/scanner.ts

21async function findArtFiles(root, include, exclude) {

22 const files = [];

23 async function scan(dir) {

24 const entries = await fs.promises.readdir(dir, { withFileTypes: true });

25 for (const entry of entries) {

26 const fullPath = path.join(dir, entry.name);

27 const relative = normalizePath(path.relative(root, fullPath));

28 let excluded = false;

29 for (const pattern of exclude) if (matchGlob(relative, pattern) || matchGlob(entry.name, pattern)) {

30 excluded = true;

31 break;

32 }

Source & flagged code

1 flagged · loading source

dist/src-DMeHW2z2.mjsView file

12package = @vizejs/musea-mcp-server; repositoryIdentity = vize; dependency = @vizejs/native L12: try { L13: native = require("@vizejs/native"); L14: return native;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src-DMeHW2z2.mjsView on unpkg · L12

Findings

1 High2 Medium3 Low

HighCopied Package Dependency Bridgedist/src-DMeHW2z2.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/src-DMeHW2z2.mjsView file

Lines 1-32javascript

1import { createRequire } from "node:module";

2import { Server } from "@modelcontextprotocol/sdk/server/index.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import { CallToolRequestSchema, ErrorCode, ListResourcesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";

5import fs from "node:fs";

6import path from "node:path";

7//#region src/native.ts

8let native = null;

9function loadNative() {

10 if (native) return native;

11 const require = createRequire(import.meta.url);

12 try {

13 native = require("@vizejs/native");

14 return native;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src-DMeHW2z2.mjsView on unpkg · L12

15 } catch (e) {

16 throw new Error(`Failed to load @vizejs/native. Make sure it's installed: ${String(e)}`);

17 }

18}

19//#endregion

20//#region src/scanner.ts

21async function findArtFiles(root, include, exclude) {

22 const files = [];

23 async function scan(dir) {

24 const entries = await fs.promises.readdir(dir, { withFileTypes: true });

25 for (const entry of entries) {

26 const fullPath = path.join(dir, entry.name);

27 const relative = normalizePath(path.relative(root, fullPath));

28 let excluded = false;

29 for (const pattern of exclude) if (matchGlob(relative, pattern) || matchGlob(entry.name, pattern)) {

30 excluded = true;

31 break;

32 }