registry / charlotteonthecheap-mcp / 0.1.0

charlotteonthecheap-mcp@0.1.0

Renamed to onthecheap-mcp, which serves all 14 On the Cheap city sites. This version's expired-deal filter is hardcoded to Charlotte and is incorrect for other cities.

Charlotte On The Cheap MCP server for Claude — developed and maintained by AI (Claude Code)

Static Scan Results

scanned 18h ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 1.49 MB of source, external domains: dom.spec.whatwg.org, github.com, html.spec.whatwg.org, html5sec.org, json-schema.org, mathiasbynens.be, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.charlotteonthecheap.com, www.safaribooksonline.com, www.w3.org

Source & flagged code

2 flagged

dist/bundle.jsView file

10901patternName = generic_password severity = medium line = 10901 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bundle.jsView on unpkg · L10901

2946sourceCode = this.opts.code.process(sourceCode, sch); L2947: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2948: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bundle.jsView on unpkg · L2946

Source & flagged code

2 flagged · loading source

dist/bundle.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code