registry / agent-services-platform / 1.0.0

agent-services-platform@1.0.0

MCP server exposing AI agent services — research, contract analysis, code review & data enrichment — with x402 micropayments on Base L2

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 22 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 166 KB of source, external domains: agents.aiscale.pro, aiscale.pro, api.cdp.coinbase.com, api.hunter.io, base.org, company.clearbit.com, example.com, facebook.com, faucet.circle.com, finviz.com, linkedin.com, newsapi.org, sepolia.base.org, twitter.com, www.alphavantage.co, x402.org

Source & flagged code

14 flagged

dist/middleware/x402-paywall.jsView file

Lines 1-40javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.getResourceServer = getResourceServer;

4exports.getPaywall = getPaywall;

5const express_1 = require("@x402/express");

6const server_1 = require("@x402/core/server");

7const x402_1 = require("@coinbase/x402");

8const server_2 = require("@x402/evm/exact/server");

9const bazaar_1 = require("@x402/extensions/bazaar");

10const x402_bazaar_config_1 = require("../config/x402-bazaar-config");

11const logger_1 = require("./logger");

12const pem_1 = require("../utils/pem");

13const network_1 = require("../config/network");

14// Normalise CDP_API_KEY_SECRET once at module load:

15// 1. Replace literal \n (Railway env var storage) with real newlines

16// 2. Convert SEC1 PEM (BEGIN EC PRIVATE KEY) → PKCS#8 (BEGIN PRIVATE KEY)

17// because jose v6 / importPKCS8 rejects SEC1 format

18{

19 let key = (process.env.CDP_API_KEY_SECRET || '').replace(/\\n/g, '\n');

20 if (key.includes('-----BEGIN EC PRIVATE KEY-----')) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/middleware/x402-paywall.jsView on unpkg · L20

Critical

Secret Pattern

EC private key in dist/middleware/x402-paywall.js

dist/middleware/x402-paywall.jsView on unpkg · L20

21 key = (0, pem_1.sec1ToP256Pkcs8Pem)(key);

22 }

23 process.env.CDP_API_KEY_SECRET = key;

24}

25/**

26 * Custom paywall provider that fixes the x402 library's display bug:

27 * the library's getDisplayAmount checks for `amount` but the V1 type

28 * field is `maxAmountRequired`, so it always falls back to 0 → "$0.00".

29 * This provider reads the correct field and formats sub-cent amounts properly.

30 */

31const aiscalePaywallProvider = {

32 generateHtml(paymentRequired, config) {

33 const firstReq = paymentRequired?.accepts?.[0];

34 const rawAmount = firstReq?.maxAmountRequired ?? firstReq?.amount ?? '0';

35 const usdAmount = parseFloat(rawAmount) / 1e6;

36 // Format with enough decimals to show sub-cent amounts (e.g. $0.002)

37 const displayAmount = usdAmount < 0.01

38 ? usdAmount.toFixed(4).replace(/0+$/, '')

39 : usdAmount.toFixed(2);

40 const appName = config?.appName ?? 'AiScale Agent Services';

dist/services/sub-agents/research-synth.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.

dist/utils/ssrf-guard.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/payments/wallet.jsView file

Lines 1-41javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.initWallet = initWallet;

4exports.getOrCreateSmartAccount = getOrCreateSmartAccount;

5exports.getWalletAddress = getWalletAddress;

6const cdp_sdk_1 =

dist/utils/pem.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.sec1ToP256Pkcs8Pem = sec1ToP256Pkcs8Pem;

4/**

5 * Converts a SEC1 EC private key PEM (-----BEGIN EC PRIVATE KEY-----)

Critical

Secret Pattern

EC private key in dist/utils/pem.js

dist/utils/pem.jsView on unpkg · L5

6 * to PKCS#8 PEM (-----BEGIN PRIVATE KEY-----) using pure Buffer arithmetic,

dist/utils/pem.d.tsView file

2patternName = private_key_ec severity = critical line = 2 matchedText = * Conver...---)

Critical

Secret Pattern

EC private key in dist/utils/pem.d.ts

dist/utils/pem.d.tsView on unpkg · L2

3patternName = private_key_rsa severity = critical line = 3 matchedText = * to PKC...tic,

Critical

Secret Pattern

RSA private key in dist/utils/pem.d.ts

dist/utils/pem.d.tsView on unpkg · L3

dist/scripts/seed-transactions.jsView file

40patternName = private_key_ec severity = critical line = 40 matchedText = if (key....)) {

Critical

Secret Pattern

EC private key in dist/scripts/seed-transactions.js

dist/scripts/seed-transactions.jsView on unpkg · L40

Source & flagged code

14 flagged · loading source

dist/middleware/x402-paywall.jsView file

20patternName = private_key_ec severity = critical line = 20 matchedText = if (key....)) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/middleware/x402-paywall.jsView on unpkg · L20

20patternName = private_key_ec severity = critical line = 20 matchedText = if (key....)) {

Critical

Secret Pattern

EC private key in dist/middleware/x402-paywall.js

dist/middleware/x402-paywall.jsView on unpkg · L20

dist/services/sub-agents/research-synth.jsView file

6exports.researchSynthHandler = researchSynthHandler; L7: const axios_1 = __importDefault(require("axios")); L8: const sdk_1 = __importDefault(require("@anthropic-ai/sdk")); ... L25: if (!parseResult.success) { L26: res.status(400).json({ error: 'Invalid request', details: parseResult.error.errors }); L27: return; L28: } L29: const anthropicKey = process.env.ANTHROPIC_API_KEY; L30: if (!anthropicKey || anthropicKey === 'your_anthropic_api_key') {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/services/sub-agents/research-synth.jsView on unpkg · L6

dist/utils/ssrf-guard.jsView file

6exports.SsrfError = void 0; L7: exports.isPrivateIP = isPrivateIP; L8: exports.validateUrl = validateUrl; ... L10: const util_1 = require("util"); L11: const axios_1 = __importDefault(require("axios")); L12: const dnsResolve = (0, util_1.promisify)(require('dns').resolve4); L13: const BLOCKED_HOSTS = new Set([

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/utils/ssrf-guard.jsView on unpkg · L6

dist/payments/wallet.jsView file

14patternName = private_key_ec severity = critical line = 14 matchedText = * 2. Con...CS#8

Critical

Secret Pattern

EC private key in dist/payments/wallet.js

dist/payments/wallet.jsView on unpkg · L14

15patternName = private_key_rsa severity = critical line = 15 matchedText = * (--...ires

Critical

Secret Pattern

RSA private key in dist/payments/wallet.js

dist/payments/wallet.jsView on unpkg · L15

21patternName = private_key_ec severity = critical line = 21 matchedText = if (pem....)) {

Critical

Secret Pattern

EC private key in dist/payments/wallet.js

dist/payments/wallet.jsView on unpkg · L21

dist/utils/pem.jsView file

5patternName = private_key_ec severity = critical line = 5 matchedText = * Conver...---)

Critical

Secret Pattern

EC private key in dist/utils/pem.js

dist/utils/pem.jsView on unpkg · L5

6patternName = private_key_rsa severity = critical line = 6 matchedText = * to PKC...tic,

Critical

Secret Pattern

RSA private key in dist/utils/pem.js

dist/utils/pem.jsView on unpkg · L6

16patternName = private_key_ec severity = critical line = 16 matchedText = .replace... '')

Critical

Secret Pattern

EC private key in dist/utils/pem.js

dist/utils/pem.jsView on unpkg · L16

65patternName = private_key_rsa severity = critical line = 65 matchedText = return `...\n`;

Critical

Secret Pattern

RSA private key in dist/utils/pem.js

dist/utils/pem.jsView on unpkg · L65

dist/utils/pem.d.tsView file

2patternName = private_key_ec severity = critical line = 2 matchedText = * Conver...---)

Critical

Secret Pattern

EC private key in dist/utils/pem.d.ts

dist/utils/pem.d.tsView on unpkg · L2

3patternName = private_key_rsa severity = critical line = 3 matchedText = * to PKC...tic,

Critical

Secret Pattern

RSA private key in dist/utils/pem.d.ts

dist/utils/pem.d.tsView on unpkg · L3

dist/scripts/seed-transactions.jsView file

40patternName = private_key_ec severity = critical line = 40 matchedText = if (key....)) {

Critical

Secret Pattern

EC private key in dist/scripts/seed-transactions.js

dist/scripts/seed-transactions.jsView on unpkg · L40

Findings

12 Critical2 High3 Medium5 Low

CriticalCritical Secretdist/middleware/x402-paywall.js

CriticalSecret Patterndist/middleware/x402-paywall.js

CriticalSecret Patterndist/payments/wallet.js

CriticalSecret Patterndist/utils/pem.js

CriticalSecret Patterndist/utils/pem.d.ts

CriticalSecret Patterndist/scripts/seed-transactions.js

HighCredential Exfiltrationdist/services/sub-agents/research-synth.js

HighCloud Metadata Accessdist/utils/ssrf-guard.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

14 flagged

dist/middleware/x402-paywall.jsView file

Lines 1-40javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.getResourceServer = getResourceServer;

4exports.getPaywall = getPaywall;

5const express_1 = require("@x402/express");

6const server_1 = require("@x402/core/server");

7const x402_1 = require("@coinbase/x402");

8const server_2 = require("@x402/evm/exact/server");

9const bazaar_1 = require("@x402/extensions/bazaar");

10const x402_bazaar_config_1 = require("../config/x402-bazaar-config");

11const logger_1 = require("./logger");

12const pem_1 = require("../utils/pem");

13const network_1 = require("../config/network");

14// Normalise CDP_API_KEY_SECRET once at module load:

15// 1. Replace literal \n (Railway env var storage) with real newlines

16// 2. Convert SEC1 PEM (BEGIN EC PRIVATE KEY) → PKCS#8 (BEGIN PRIVATE KEY)

17// because jose v6 / importPKCS8 rejects SEC1 format

18{

19 let key = (process.env.CDP_API_KEY_SECRET || '').replace(/\\n/g, '\n');

20 if (key.includes('-----BEGIN EC PRIVATE KEY-----')) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/middleware/x402-paywall.jsView on unpkg · L20

Critical

Secret Pattern

EC private key in dist/middleware/x402-paywall.js

dist/middleware/x402-paywall.jsView on unpkg · L20

21 key = (0, pem_1.sec1ToP256Pkcs8Pem)(key);

22 }

23 process.env.CDP_API_KEY_SECRET = key;

24}

25/**

26 * Custom paywall provider that fixes the x402 library's display bug:

27 * the library's getDisplayAmount checks for `amount` but the V1 type

28 * field is `maxAmountRequired`, so it always falls back to 0 → "$0.00".

29 * This provider reads the correct field and formats sub-cent amounts properly.

30 */

31const aiscalePaywallProvider = {

32 generateHtml(paymentRequired, config) {

33 const firstReq = paymentRequired?.accepts?.[0];

34 const rawAmount = firstReq?.maxAmountRequired ?? firstReq?.amount ?? '0';

35 const usdAmount = parseFloat(rawAmount) / 1e6;

36 // Format with enough decimals to show sub-cent amounts (e.g. $0.002)

37 const displayAmount = usdAmount < 0.01

38 ? usdAmount.toFixed(4).replace(/0+$/, '')

39 : usdAmount.toFixed(2);

40 const appName = config?.appName ?? 'AiScale Agent Services';

dist/services/sub-agents/research-synth.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.

dist/utils/ssrf-guard.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/payments/wallet.jsView file

Lines 1-41javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.initWallet = initWallet;

4exports.getOrCreateSmartAccount = getOrCreateSmartAccount;

5exports.getWalletAddress = getWalletAddress;

6const cdp_sdk_1 =

dist/utils/pem.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.sec1ToP256Pkcs8Pem = sec1ToP256Pkcs8Pem;

4/**

5 * Converts a SEC1 EC private key PEM (-----BEGIN EC PRIVATE KEY-----)

Critical

Secret Pattern

EC private key in dist/utils/pem.js

dist/utils/pem.jsView on unpkg · L5

6 * to PKCS#8 PEM (-----BEGIN PRIVATE KEY-----) using pure Buffer arithmetic,

dist/utils/pem.d.tsView file

2patternName = private_key_ec severity = critical line = 2 matchedText = * Conver...---)

Critical

Secret Pattern

EC private key in dist/utils/pem.d.ts

dist/utils/pem.d.tsView on unpkg · L2

3patternName = private_key_rsa severity = critical line = 3 matchedText = * to PKC...tic,

Critical

Secret Pattern

RSA private key in dist/utils/pem.d.ts

dist/utils/pem.d.tsView on unpkg · L3

dist/scripts/seed-transactions.jsView file

40patternName = private_key_ec severity = critical line = 40 matchedText = if (key....)) {

Critical

Secret Pattern

EC private key in dist/scripts/seed-transactions.js

dist/scripts/seed-transactions.jsView on unpkg · L40