registry / @xevy/cli / 0.1.1

@xevy/cli@0.1.1

Xevy CLI — one command (`xevy setup`) installs the Xevy SDLC agent skills and the OAuth MCP server globally for Cursor, Claude Code, and 50+ agents. No API key required.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 9.35 KB of source, external domains: xevy.ai, xevy.vyte.dev

Source & flagged code

1 flagged

bin/xevy.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * @xevy/cli — the `xevy` command.

4 *

5 * `xevy setup` installs the Xevy SDLC agent skills and the Xevy MCP server

6 * globally, for Cursor / Claude Code / 50+ agents. The MCP server authenticates

7 * via OAuth (completed inside the agent on first connect) — there is NO API key

8 * to find, paste, or store. No repo/project detection or linking happens here.

9 *

10 * Under the hood it drives the same primitives the Xevy docs recommend:

11 * • `npx skills add <dir>` — copies/symlinks the skills into agent scopes

12 * • `npx add-mcp <url>` — writes the agent MCP config (OAuth on connect)

13 * Skills are sourced from the pinned `@xevy/skills` dependency, so this CLI

14 * stays in step with the published skills without duplicating them.

15 *

16 * Usage:

17 * npx @xevy/cli setup Install skills + MCP globally (OAuth)

18 * npx @xevy/cli setup -a cursor Only a specific agent (repeatable)

19 * npx @xevy/cli setup --mcp-only Configure the OAuth MCP server only

20 * npx @xevy/cli --version

21 */

22import { spawnSync } from "node:child_process";

23import { createRequire } from "node:module";

24import fs from "node:fs";

25import os from "node:os";

26import path from "node:path";

27import { fileURLToPath } from "node:url";

29const require = createRequire(import.meta.url);

30const here = path.dirname(fileURLToPath(import.meta.url));

31const pkgRoot = path.resolve(here, "..");

33const DEFAULT_BASE = "https://xevy.ai";

34const DEFAULT_AGENTS = ["cursor", "claude-code"];

35const isWindows = process.platform === "win32";

37const PI_PACKAGE = "@mariozechner/pi-coding-agent";

38const PI_EXTENSION_DIR = path.join(os.homedir(), ".pi", "agent", "extensions");

39// pi extensions installed by `xevy pi` — file name + a marker string used to

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/xevy.mjsView on unpkg · L21

40// sanity-check the download isn't SPA HTML (wrong --base).

41const PI_EXTENSIONS = [

Source & flagged code

1 flagged · loading source

bin/xevy.mjsView file

21*/ L22: import { spawnSync } from "node:child_process"; L23: import { createRequire } from "node:module"; ... L32: L33: const DEFAULT_BASE = "https://xevy.ai"; L34: const DEFAULT_AGENTS = ["cursor", "claude-code"]; L35: const isWindows = process.platform === "win32"; L36: L37: const PI_PACKAGE = "@mariozechner/pi-coding-agent"; L38: const PI_EXTENSION_DIR = path.join(os.homedir(), ".pi", "agent", "extensions"); L39: // pi extensions installed by `xevy pi` — file name + a marker string used to ... L47: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/xevy.mjsView on unpkg · L21

Findings

1 High2 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/xevy.mjs

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

bin/xevy.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * @xevy/cli — the `xevy` command.

4 *

5 * `xevy setup` installs the Xevy SDLC agent skills and the Xevy MCP server

6 * globally, for Cursor / Claude Code / 50+ agents. The MCP server authenticates

7 * via OAuth (completed inside the agent on first connect) — there is NO API key

8 * to find, paste, or store. No repo/project detection or linking happens here.

9 *

10 * Under the hood it drives the same primitives the Xevy docs recommend:

11 * • `npx skills add <dir>` — copies/symlinks the skills into agent scopes

12 * • `npx add-mcp <url>` — writes the agent MCP config (OAuth on connect)

13 * Skills are sourced from the pinned `@xevy/skills` dependency, so this CLI

14 * stays in step with the published skills without duplicating them.

15 *

16 * Usage:

17 * npx @xevy/cli setup Install skills + MCP globally (OAuth)

18 * npx @xevy/cli setup -a cursor Only a specific agent (repeatable)

19 * npx @xevy/cli setup --mcp-only Configure the OAuth MCP server only

20 * npx @xevy/cli --version

21 */

22import { spawnSync } from "node:child_process";

23import { createRequire } from "node:module";

24import fs from "node:fs";

25import os from "node:os";

26import path from "node:path";

27import { fileURLToPath } from "node:url";

29const require = createRequire(import.meta.url);

30const here = path.dirname(fileURLToPath(import.meta.url));

31const pkgRoot = path.resolve(here, "..");

33const DEFAULT_BASE = "https://xevy.ai";

34const DEFAULT_AGENTS = ["cursor", "claude-code"];

35const isWindows = process.platform === "win32";

37const PI_PACKAGE = "@mariozechner/pi-coding-agent";

38const PI_EXTENSION_DIR = path.join(os.homedir(), ".pi", "agent", "extensions");

39// pi extensions installed by `xevy pi` — file name + a marker string used to

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/xevy.mjsView on unpkg · L21

40// sanity-check the download isn't SPA HTML (wrong --base).

41const PI_EXTENSIONS = [