registry / aifp-mcp / 1.2.0

aifp-mcp@1.2.0

AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 20 file(s), 126 KB of source, external domains: hf-mirror.com, huggingface.co, registry.npmjs.org, your-server.com

Source & flagged code

5 flagged

package.jsonView file

Lines 1-38json

2 "name": "aifp-mcp",

3 "version": "1.2.0",

4 "description": "AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "aifp-mcp": "dist/index.js",

9 "aifp-setup": "dist/setup.js"

10 },

11 "scripts": {

12 "start": "tsx src/index.ts",

13 "server": "tsx src/server.ts",

14 "setup": "tsx src/setup.ts",

15 "setup:dist": "node dist/setup.js",

16 "build": "tsc",

17 "prepublishOnly": "tsc",

18 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "publishConfig": {

21 "access": "public"

22 },

23 "files": [

24 "dist/",

25 "dist/hooks/",

26 "scripts/",

27 "README.md",

28 "package.json"

29 ],

30 "dependencies": {

31 "@modelcontextprotocol/sdk": "^1.29.0",

32 "@xenova/transformers": "^2.17.2"

33 },

34 "optionalDependencies": {

35 "@zvec/zvec": "^0.5.0"

36 },

37 "devDependencies": {

38 "@types/node": "^26.0.1",

dist/setup.jsView file

Lines 1-24javascript

1import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';

2import { homedir } from 'os';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

5import { execSync } from 'child_process';

dist/import.jsView file

Lines 117-157javascript

117 if (formats.includes(ext)) {

118 out.push({ path: full, format: ext, mtimeMs: st.mtimeMs });

119 }

120 }

121 catch { }

122 }

123}

124export async function importSources() {

125

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/setup.jsView file

4import { fileURLToPath } from 'url'; L5: import { execSync } from 'child_process'; L6: const __filename = fileURLToPath(import.meta.url);

High

Child Process

Package source references child process execution.

dist/setup.jsView on unpkg · L4

99}); L100: const codexCommand = isSourceMode ? `npx tsx "${SRC_ENTRY}"` : `node "${DIST_ENTRY}"`; L101: if (detect('codex')) { L102: try { L103: execSync(`codex mcp add ai-cognition -- ${codexCommand}`, { stdio: 'ignore', timeout: 5000 }); L104: results.push({ name: 'Codex CLI', configured: true, message: '已通过 codex mcp add 配置' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup.jsView on unpkg · L99

dist/import.jsView file

137else { L138: items = parseJsonItems(JSON.parse(text)); L139: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/import.jsView on unpkg · L137

Findings

4 High4 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/setup.js

HighShell

HighRuntime Package Installdist/setup.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/import.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 1-38json

2 "name": "aifp-mcp",

3 "version": "1.2.0",

4 "description": "AiFP 记忆感知系统 — 没有记录，只做记忆感知 MCP Server",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "aifp-mcp": "dist/index.js",

9 "aifp-setup": "dist/setup.js"

10 },

11 "scripts": {

12 "start": "tsx src/index.ts",

13 "server": "tsx src/server.ts",

14 "setup": "tsx src/setup.ts",

15 "setup:dist": "node dist/setup.js",

16 "build": "tsc",

17 "prepublishOnly": "tsc",

18 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "publishConfig": {

21 "access": "public"

22 },

23 "files": [

24 "dist/",

25 "dist/hooks/",

26 "scripts/",

27 "README.md",

28 "package.json"

29 ],

30 "dependencies": {

31 "@modelcontextprotocol/sdk": "^1.29.0",

32 "@xenova/transformers": "^2.17.2"

33 },

34 "optionalDependencies": {

35 "@zvec/zvec": "^0.5.0"

36 },

37 "devDependencies": {

38 "@types/node": "^26.0.1",

dist/setup.jsView file

Lines 1-24javascript

1import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';

2import { homedir } from 'os';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

5import { execSync } from 'child_process';

dist/import.jsView file

Lines 117-157javascript

117 if (formats.includes(ext)) {

118 out.push({ path: full, format: ext, mtimeMs: st.mtimeMs });

119 }

120 }

121 catch { }

122 }

123}

124export async function importSources() {

125

Lines 79-119javascript

79 results.push({ name: 'VS Code Claude 扩展', configured: false, message: '未检测到 ~/.claude/ 目录（跳过）' });

80}

81const cursorDir = resolve(OUTPUT_DIR, '.cursor');

82const cursorMcpPath = resolve(cursorDir, 'mcp.json');

83if (!existsSync(cursorDir))

84 mkdirSync(cursorDir, { recursive: true });

85const cursorOk = writeJson(cursorMcpPath, { mcpServers: { 'ai-cognition': MCP_CONFIG } });

86results.push({

87 name: 'Cursor',

88 configured: cursorOk,

89 message: cursorOk ? `已写入 ${cursorMcpPath}` : '写入失败',

90});

91const windsurfConfigPath = resolve(HOME, '.codeium', 'windsurf', 'mcp_config.json');

92const windsurfOk = writeJson(windsurfConfigPath, {

93 mcpServers: { 'ai-cognition': MCP_CONFIG },

94});

95results.push({

96 name: 'Windsurf',

97 configured: windsurfOk,

98 message: windsurfOk ? `已写入 ${windsurfConfigPath}` : '写入失败',

99});

100const codexCommand = isSourceMode ? `npx tsx "${SRC_ENTRY}"` : `node "${DIST_ENTRY}"`;

101if (detect('codex')) {

102 try {

103 execSync(`codex mcp add ai-cognition -- ${codexCommand}`, { stdio: 'ignore', timeout: 5000 });

104 results.push({ name: 'Codex CLI', configured: true, message: '已通过 codex mcp add 配置' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup.jsView on unpkg · L99

105 }

106 catch {

107 const codexConfigDir = resolve(HOME, '.codex');

108 const codexConfigPath = resolve(codexConfigDir, 'config.toml');

109 if (!existsSync(codexConfigDir))

110 mkdirSync(codexConfigDir, { recursive: true });

111 try {

112 const cmd = isSourceMode ? 'npx' : 'node';

113 const arg = isSourceMode ? SRC_ENTRY : DIST_ENTRY;

114 const toml = `[mcp_servers.ai-cognition]\ncommand = "${cmd}"\nargs = ["${arg.replace(/\\/g, '\\\\')}"]\n`;

115 writeFileSync(codexConfigPath, toml);

116 results.push({ name: 'Codex CLI', configured: true, message: `已追加到 ${codexConfigPath}` });

117 }

118 catch {

119 results.push({ name: 'Codex CLI', configured: false, message: '手动配置: 见 AGENTS.md 说明' });