registry / bot-relay-mcp / 2.14.0

bot-relay-mcp@2.14.0

MCP server for AI coding agent terminal-to-terminal communication. Local-first, SQLite-backed, webhook-integrated.

Static Scan Results

scanned 20d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 79 file(s), 1.01 MB of source, external domains: 127.0.0.1, github.com, nodejs.org, relay.example.com

Source & flagged code

4 flagged

dist/sqlite-compat.jsView file

Lines 104-144javascript

104 }

105 }

106}

107class WasmDatabase {

108 db;

109 dbPath;

110 txDepth = 0;

111 constructor(rawDb, dbPath) {

112 this.db = rawDb;

113 this.dbPath = dbPath;

114 // Attach conditional flush so WasmStatement can call it.

115 // Skips actual flush when inside a transaction (depth > 0) — the

116 // transaction() wrapper handles flushing at COMMIT/ROLLBACK.

117 this.db.__flush = () => {

118 if (this.txDepth === 0)

119 this.flush();

120 };

121 }

122 prepare(sql) {

123 return new WasmStatement(this.db, sql);

124 }

125 exec(sql) {

126 this.db.run(sql);

High

Child Process

Package source references child process execution.

dist/sqlite-compat.jsView on unpkg · L124

127 // v2.0 beta: respect txDepth so exec() inside a transaction doesn't flush

128 // mid-way. Calling export() between DDL statements inside an open

129 // transaction loses the in-memory state that hasn't yet been committed.

130 if (this.txDepth === 0)

131 this.flush();

132 return this;

133 }

134 pragma(source, _options) {

135 // Intercept WAL mode — wasm operates in-memory with write-back. WAL,

136 // DELETE, and other journal modes that touch the filesystem are meaningless

137 // (and may error on Emscripten's virtual FS). Simply no-op and return the

138 // current mode.

139 if (/journal_mode/i.test(source)) {

140 log.info("[db-wasm] journal_mode pragma skipped on wasm driver (in-memory + write-back).");

141 return "memory";

142 }

143 // busy_timeout has no effect on in-memory wasm (single-process, no locking).

144 if (/busy_timeout/i.test(source)) {

dist/cli/open.jsView file

Lines 1-32javascript

1// bot-relay-mcp

3// SPDX-License-Identifier: MIT

4// See LICENSE for full terms.

5/**

6 * v2.2.2 C1 — `relay open` subcommand.

7 *

8 * Opens the dashboard URL in the operator's default browser. Reads

9 * RELAY_HTTP_HOST + RELAY_HTTP_PORT (or ~/.bot-relay/config.json),

10 * probes the daemon, and shells to the platform-native opener:

11 * darwin → open <url>

bin/spawn-agent.shView file

•path = bin/spawn-agent.sh kind = build_helper sizeBytes = 18823 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/spawn-agent.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/sqlite-compat.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code