registry / @vscxml/mcp / 0.1.37

@vscxml/mcp@0.1.37

MCP server for the VSCXML suite — 50 tools for designing, simulating, generating, and visually editing W3C SCXML state machines via LLMs (Claude Code, Claude Desktop, Cursor)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 171 KB of source, external domains: vscxml.com

Source & flagged code

2 flagged

dist/bin/scxml-mcp.jsView file

Lines 1-51javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { execSync } from 'child_process';

4import { startStdio } from '../index.js';

High

Child Process

Package source references child process execution.

dist/bin/scxml-mcp.jsView on unpkg · L2

5const require = createRequire(import.meta.url);

6const pkg = require('../../package.json');

7// Parse CLI arguments

8const args = process.argv.slice(2);

9const config = {};

10for (let i = 0; i < args.length; i++) {

11 switch (args[i]) {

12 case '--generator':

13 config.generatorUrl = args[++i];

14 break;

15 case '--simulator':

16 config.simulatorUrl = args[++i];

17 break;

18 case '--editor':

19 config.editorUrl = args[++i];

20 break;

21 case '--version':

22 case '-v':

23 console.log(`@vscxml/mcp ${pkg.version}`);

24 process.exit(0);

25 case '--setup': {

26 // Auto-register MCP server in Claude Code config

27 const scope = args[i + 1] === '--user' ? '-s user ' : '';

28 if (args[i + 1] === '--user')

29 i++;

30 const isWindows = process.platform === 'win32';

31 const cmd = isWindows

32 ? `claude mcp add ${scope}vscxml -- cmd /c npx -y @vscxml/mcp`

33 : `claude mcp add ${scope}vscxml -- npx -y @vscxml/mcp`;

34 console.log(`Registering MCP server: ${cmd}`);

35 try {

36 execSync(cmd, { stdio: 'inherit' });

37 console.log('MCP server registered. Restart Claude Code to activate.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/scxml-mcp.jsView on unpkg · L31

38 }

39 catch {

40 console.error('Failed to register. Is Claude Code CLI installed?');

41 console.error('Manual setup: ' + cmd);

42 process.exit(1);

43 }

44 process.exit(0);

45 }

46 case '--help':

47 console.error(`

48@vscxml/mcp ${pkg.version} - MCP server for VSCXML state machine suite

50Usage: vscxml-mcp [options]

Source & flagged code

2 flagged · loading source

dist/bin/scxml-mcp.jsView file

2import { createRequire } from 'module'; L3: import { execSync } from 'child_process'; L4: import { startStdio } from '../index.js';

High

Child Process

Package source references child process execution.

dist/bin/scxml-mcp.jsView on unpkg · L2

31const cmd = isWindows L32: ? `claude mcp add ${scope}vscxml -- cmd /c npx -y @vscxml/mcp` L33: : `claude mcp add ${scope}vscxml -- npx -y @vscxml/mcp`; ... L35: try { L36: execSync(cmd, { stdio: 'inherit' }); L37: console.log('MCP server registered. Restart Claude Code to activate.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/scxml-mcp.jsView on unpkg · L31

Findings

3 High3 Medium5 Low

HighChild Processdist/bin/scxml-mcp.js

HighShell

HighRuntime Package Installdist/bin/scxml-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/bin/scxml-mcp.jsView file

Lines 1-51javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { execSync } from 'child_process';

4import { startStdio } from '../index.js';

High

Child Process

Package source references child process execution.

dist/bin/scxml-mcp.jsView on unpkg · L2

5const require = createRequire(import.meta.url);

6const pkg = require('../../package.json');

7// Parse CLI arguments

8const args = process.argv.slice(2);

9const config = {};

10for (let i = 0; i < args.length; i++) {

11 switch (args[i]) {

12 case '--generator':

13 config.generatorUrl = args[++i];

14 break;

15 case '--simulator':

16 config.simulatorUrl = args[++i];

17 break;

18 case '--editor':

19 config.editorUrl = args[++i];

20 break;

21 case '--version':

22 case '-v':

23 console.log(`@vscxml/mcp ${pkg.version}`);

24 process.exit(0);

25 case '--setup': {

26 // Auto-register MCP server in Claude Code config

27 const scope = args[i + 1] === '--user' ? '-s user ' : '';

28 if (args[i + 1] === '--user')

29 i++;

30 const isWindows = process.platform === 'win32';

31 const cmd = isWindows

32 ? `claude mcp add ${scope}vscxml -- cmd /c npx -y @vscxml/mcp`

33 : `claude mcp add ${scope}vscxml -- npx -y @vscxml/mcp`;

34 console.log(`Registering MCP server: ${cmd}`);

35 try {

36 execSync(cmd, { stdio: 'inherit' });

37 console.log('MCP server registered. Restart Claude Code to activate.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/scxml-mcp.jsView on unpkg · L31

38 }

39 catch {

40 console.error('Failed to register. Is Claude Code CLI installed?');

41 console.error('Manual setup: ' + cmd);

42 process.exit(1);

43 }

44 process.exit(0);

45 }

46 case '--help':

47 console.error(`

48@vscxml/mcp ${pkg.version} - MCP server for VSCXML state machine suite

50Usage: vscxml-mcp [options]