registry  /  @vscxml/mcp  /  0.1.37

@vscxml/mcp@0.1.37

MCP server for the VSCXML suite — 50 tools for designing, simulating, generating, and visually editing W3C SCXML state machines via LLMs (Claude Code, Claude Desktop, Cursor)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 9 file(s), 171 KB of source, external domains: vscxml.com

Source & flagged code

2 flagged · loading source
dist/bin/scxml-mcp.jsView file
2import { createRequire } from 'module'; L3: import { execSync } from 'child_process'; L4: import { startStdio } from '../index.js';
High
Child Process

Package source references child process execution.

dist/bin/scxml-mcp.jsView on unpkg · L2
31const cmd = isWindows L32: ? `claude mcp add ${scope}vscxml -- cmd /c npx -y @vscxml/mcp` L33: : `claude mcp add ${scope}vscxml -- npx -y @vscxml/mcp`; ... L35: try { L36: execSync(cmd, { stdio: 'inherit' }); L37: console.log('MCP server registered. Restart Claude Code to activate.');
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/scxml-mcp.jsView on unpkg · L31

Findings

3 High3 Medium5 Low
HighChild Processdist/bin/scxml-mcp.js
HighShell
HighRuntime Package Installdist/bin/scxml-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings