registry / autojs6-mcp / 0.1.1

autojs6-mcp@0.1.1

MCP server for AutoJs6 remote control (DevPlugin protocol) and ADB workflows

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 41.4 KB of source

Source & flagged code

1 flagged

dist/lib/devSocket.jsView file

Lines 1-21javascript

1import net from "node:net";

2import crypto from "node:crypto";

3import { EventEmitter } from "node:events";

4/**

5 * AutoJs6 DevPlugin wire protocol (verified from AutoJs6 source).

6 *

7 * Frame: [ 8-byte big-endian header ][ payload ]

8 * header = int32 dataLength + int32 dataType

9 * dataType: 1 = JSON (UTF-8), 2 = BYTES (raw)

10 *

11 * JSON payload shape: { "type": "...", "data": { ... } }

12 * Commands are routed on `data.command`.

13 *

14 * Device pushes:

15 * - { type: "hello", data: { device_name, app_version, app_version_code, device_id } }

16 * - { type: "log", data: { log: "..." } } (no per-script id; multiplexed)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/devSocket.jsView on unpkg · L1

17 *

18 * PC sends:

19 * - { type: "command", data: { command: "run"|"stop"|"stopAll"|"save", id, name, script } }

20 * - bytes_command: a JSON frame { type: "bytes_command", data: { command, id, name, md5 } }

21 * followed by a BYTES frame whose payload is the zip; md5 = md5hex(id) per device side.

Source & flagged code

1 flagged · loading source

dist/lib/devSocket.jsView file

1import net from "node:net"; L2: import crypto from "node:crypto"; ... L14: * Device pushes: L15: * - { type: "hello", data: { device_name, app_version, app_version_code, device_id } } L16: * - { type: "log", data: { log: "..." } } (no per-script id; multiplexed) ... L95: if (dataType === TYPE_JSON) { L96: this.handleJsonFrame(payload.toString("utf8")); L97: }

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code