registry / @vizejs/musea-mcp-server / 0.290.0

@vizejs/musea-mcp-server@0.290.0

MCP server for building Vue.js design systems - component analysis, documentation, variant generation, and design tokens

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 67.7 KB of source

Source & flagged code

1 flagged

dist/src-CqGFwjgv.mjsView file

Lines 1-34javascript

1import { createRequire } from "node:module";

2import { Server } from "@modelcontextprotocol/sdk/server/index.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import { CallToolRequestSchema, ErrorCode, ListResourcesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";

5import fs from "node:fs";

6import path from "node:path";

7import { NodeTypes, baseParse } from "@vue/compiler-dom";

8import ts from "typescript";

9//#region src/native.ts

10let native = null;

11function loadNative() {

12 if (native) return native;

13 const require = createRequire(import.meta.url);

14 try {

15 native = require("@vizejs/native");

16 return native;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src-CqGFwjgv.mjsView on unpkg · L14

17 } catch (e) {

18 throw new Error(`Failed to load @vizejs/native. Make sure it's installed: ${String(e)}`);

19 }

20}

21//#endregion

22//#region src/scanner.ts

23async function findArtFiles(root, include, exclude) {

24 const files = [];

25 async function scan(dir) {

26 const entries = await fs.promises.readdir(dir, { withFileTypes: true });

27 for (const entry of entries) {

28 const fullPath = path.join(dir, entry.name);

29 const relative = normalizePath(path.relative(root, fullPath));

30 let excluded = false;

31 for (const pattern of exclude) if (matchGlob(relative, pattern) || matchGlob(entry.name, pattern)) {

32 excluded = true;

33 break;

34 }

Source & flagged code

1 flagged · loading source

dist/src-CqGFwjgv.mjsView file

14package = @vizejs/musea-mcp-server; repositoryIdentity = vize; dependency = @vizejs/native L14: try { L15: native = require("@vizejs/native"); L16: return native;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src-CqGFwjgv.mjsView on unpkg · L14

Findings

1 High2 Medium3 Low

HighCopied Package Dependency Bridgedist/src-CqGFwjgv.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/src-CqGFwjgv.mjsView file

Lines 1-34javascript

1import { createRequire } from "node:module";

2import { Server } from "@modelcontextprotocol/sdk/server/index.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import { CallToolRequestSchema, ErrorCode, ListResourcesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";

5import fs from "node:fs";

6import path from "node:path";

7import { NodeTypes, baseParse } from "@vue/compiler-dom";

8import ts from "typescript";

9//#region src/native.ts

10let native = null;

11function loadNative() {

12 if (native) return native;

13 const require = createRequire(import.meta.url);

14 try {

15 native = require("@vizejs/native");

16 return native;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src-CqGFwjgv.mjsView on unpkg · L14

17 } catch (e) {

18 throw new Error(`Failed to load @vizejs/native. Make sure it's installed: ${String(e)}`);

19 }

20}

21//#endregion

22//#region src/scanner.ts

23async function findArtFiles(root, include, exclude) {

24 const files = [];

25 async function scan(dir) {

26 const entries = await fs.promises.readdir(dir, { withFileTypes: true });

27 for (const entry of entries) {

28 const fullPath = path.join(dir, entry.name);

29 const relative = normalizePath(path.relative(root, fullPath));

30 let excluded = false;

31 for (const pattern of exclude) if (matchGlob(relative, pattern) || matchGlob(entry.name, pattern)) {

32 excluded = true;

33 break;

34 }