registry / argus-decision-mcp / 1.3.1

argus-decision-mcp@1.3.1

Argus decision-accountability MCP server — clarify a decision, save a falsifiable prediction, and record what reality did. The model never grades you.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 115 file(s), 883 KB of source, external domains: 127.0.0.1, argus.voyage

Source & flagged code

1 flagged

dist/a0/account-connect.jsView file

Lines 1-21javascript

1import { createServer } from 'node:http';

2import { randomBytes, createHash } from 'node:crypto';

3import { spawn } from 'node:child_process';

4import { writeStoredAccountCredential, } from './account-credentials.js';

5const DEFAULT_API_URL = 'https://argus.voyage';

6const CONNECT_TIMEOUT_MS = 5 * 60 * 1000;

7function apiBase(value) {

8 const url = new URL(value.replace(/\/+$/, ''));

9 const local = url.hostname === '127.0.0.1' || url.hostname === 'localhost' || url.hostname === '::1';

10 if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) {

11 throw new Error('ARGUS_API_URL must use HTTPS (HTTP is allowed only for localhost).');

12 }

13 return url.toString().replace(/\/+$/, '');

14}

15function base64url(bytes = 32) {

16 return randomBytes(bytes).toString('base64url');

17}

18function challenge(verifier) {

19 return createHash('sha256').update(verifier).digest('base64url');

20}

21async function defaultOpenExternal(url) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/a0/account-connect.jsView on unpkg · L1

Source & flagged code

1 flagged · loading source

dist/a0/account-connect.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code