registry / arko-mcp / 0.3.0

arko-mcp@0.3.0

ARKO Model Context Protocol server — brings the ARKO security control engine into Claude Code, Cursor, and any MCP-compatible AI coding agent.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 89.7 KB of source, external domains: arko.devsecai.io, cognito-idp.eu-west-2.amazonaws.com, eu-west-2k1krhmvmy.auth.eu-west-2.amazoncognito.com, www.w3.org

Source & flagged code

2 flagged

dist/auth/login.jsView file

Lines 1-28javascript

1/**

2 * Interactive `arko-mcp login` — browser OAuth (Cognito Hosted UI + PKCE).

3 *

4 * The developer signs in with their work email; the backend resolves their

5 * enterprise tenant from the email domain, so subsequent scans land in that

6 * organisation's Control Plane. Result is a cached refresh token; the server

7 * then runs unattended.

8 */

9import { spawn } from "node:child_process";

10import { platform } from "node:os";

High

Child Process

Package source references child process execution.

dist/auth/login.jsView on unpkg · L8

11import { generatePkce, randomState } from "./pkce.js";

12import { buildAuthorizeUrl, exchangeCode } from "./cognito.js";

13import { awaitOAuthCallback } from "./loopback.js";

14import { saveCredentials } from "./credentials.js";

15/** Best-effort browser open; always prints the URL as a fallback (SSH/headless). */

16function openBrowser(url) {

17 const cmd = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";

18 const args = platform() === "win32" ? ["/c", "start", "", url] : [url];

19 try {

20 const child = spawn(cmd, args, { stdio: "ignore", detached: true });

21 child.on("error", () => { });

22 child.unref();

23 }

24 catch {

25 /* fall back to the printed URL */

26 }

27}

28/** Decode (without verifying) the claims of a JWT for display only. */

dist/initcmd.jsView file

Lines 15-55javascript

15 */

16import { execFileSync } from "node:child_process";

17import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

18import { join } from "node:path";

19const MARKER_START

Source & flagged code

2 flagged · loading source

dist/auth/login.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code