registry / chrome-devtools-mcp / 1.5.0

chrome-devtools-mcp@1.5.0

MCP server for Chrome DevTools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 1.88 MB of source, external domains: 127.0.0.1, chromestatus.com, chromeuxreport.googleapis.com, chromium.googlesource.com, chromiumdash.appspot.com, crbug.com, datatracker.ietf.org, developer.chrome.com, developer.mozilla.org, developers.google.com, example.com, fedidcg.github.io, ffmpeg.org, github.com, html.spec.whatwg.org, play.googleapis.com, policies.google.com, privacycg.github.io, privacysandbox.com, registry.npmjs.org, urlpattern.spec.whatwg.org, web.dev, wicg.github.io, www.chromium.org, www.ffmpeg.org, www.ietf.org, www.rfc-editor.org

Oversized source lightweight scan

build/src/third_party/index.js6.52 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoShellHighEntropyStringsUrlStringschromestatus.comchromium.googlesource.comchromiumdash.appspot.comcrbug.comdatatracker.ietf.orgdeveloper.chrome.comdeveloper.mozilla.orgdevelopers.google.comexample.comfedidcg.github.iogithub.comhtml.spec.whatwg.orgprivacycg.github.ioprivacysandbox.comweb.devwicg.github.iowww.chromium.orgwww.ietf.orgwww.rfc-editor.org

build/src/third_party/lighthouse-devtools-mcp-bundle.js8.08 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsgithub.com

Source & flagged code

4 flagged

build/src/tools/performance.jsView file

Lines 159-199javascript

159 if (traceResultIsSuccess(result)) {

160 if (context.isCruxEnabled()) {

161 await populateCruxData(result);

162 }

163 context.storeTraceRecording(result);

164 response.attachTraceSummary(result);

165 }

166 else {

167 throw new Error(`There was an unexpected error parsing the trace: ${result.error}`);

168 }

169 }

170 finally {

171 context.setIsRunningPerformanceTrace(false);

172 }

173}

174/** We tell CrUXManager to fetch data so it's available when DevTools.PerformanceTraceFormatter is invoked */

175async function populateCruxData(result) {

176 logger?.('populateCruxData called');

177 const cruxManager = DevTools.CrUXManager.CrUXManager.instance();

178 // go/jtfbx. Yes, we're aware this API key is public. ;)

179 cruxManager.setEndpointForTesting('https://chromeuxreport.googleapis.com/v1/records:queryRecord?key=AIzaSyBn5gimNjhiEyA_euicSKko6IlD3HdgUfk');

High

High Secret

Package contains a high-severity secret pattern.

build/src/tools/performance.jsView on unpkg · L179

High

Secret Pattern

Google API key in build/src/tools/performance.js

build/src/tools/performance.jsView on unpkg · L179

180 const cruxSetting = DevTools.Common.Settings.Settings.instance().createSetting('field-data', {

181 enabled: true,

182 });

183 cruxSetting.set({ enabled: true });

184 // Gather URLs to fetch CrUX data for

185 const urls = [...(result.parsedTrace.insights?.values() ?? [])].map(c => c.url.toString());

186 urls.push(result.parsedTrace.data.Meta.mainFrameURL);

187 const urlSet = new Set(urls);

188 if (urlSet.size === 0) {

189 logger?.('No URLs found for CrUX data');

190 return;

191 }

192 logger?.(`Fetching CrUX data for ${urlSet.size} URLs: ${Array.from(urlSet).join(', ')}`);

193 const cruxData = await Promise.all(Array.from(urlSet).map(async (url) => {

194 const data = await cruxManager.getFieldDataForPage(url);

195 logger?.(`CrUX data for ${url}: ${data ? 'found' : 'not found'}`);

196 return data;

197 }));

198 result.parsedTrace.metadata.cruxFieldData = cruxData;

199}

build/src/third_party/devtools-formatter-worker.jsView file

8376} L8377: eval(val) { L8378: const sign = val < 0 ? -1 : 1.0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/src/third_party/devtools-formatter-worker.jsView on unpkg · L8376

build/src/third_party/lighthouse-devtools-mcp-bundle.jsView file

•path = build/src/third_party/lighthouse-devtools-mcp-bundle.js kind = oversized_source_file sizeBytes = 8475771 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/src/third_party/lighthouse-devtools-mcp-bundle.jsView on unpkg

Source & flagged code

4 flagged · loading source

build/src/tools/performance.jsView file

179patternName = google_api_key severity = high line = 179 matchedText = cruxMana...k');

High

High Secret

Package contains a high-severity secret pattern.

build/src/tools/performance.jsView on unpkg · L179

179patternName = google_api_key severity = high line = 179 matchedText = cruxMana...k');

High

Secret Pattern

Google API key in build/src/tools/performance.js

build/src/tools/performance.jsView on unpkg · L179

build/src/third_party/devtools-formatter-worker.jsView file

8376} L8377: eval(val) { L8378: const sign = val < 0 ? -1 : 1.0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/src/third_party/devtools-formatter-worker.jsView on unpkg · L8376

build/src/third_party/lighthouse-devtools-mcp-bundle.jsView file

•path = build/src/third_party/lighthouse-devtools-mcp-bundle.js kind = oversized_source_file sizeBytes = 8475771 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/src/third_party/lighthouse-devtools-mcp-bundle.jsView on unpkg

Findings

3 High3 Medium6 Low

HighHigh Secretbuild/src/tools/performance.js

HighOversized Source Filebuild/src/third_party/lighthouse-devtools-mcp-bundle.js

HighSecret Patternbuild/src/tools/performance.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalbuild/src/third_party/devtools-formatter-worker.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

build/src/tools/performance.jsView file

Lines 159-199javascript

159 if (traceResultIsSuccess(result)) {

160 if (context.isCruxEnabled()) {

161 await populateCruxData(result);

162 }

163 context.storeTraceRecording(result);

164 response.attachTraceSummary(result);

165 }

166 else {

167 throw new Error(`There was an unexpected error parsing the trace: ${result.error}`);

168 }

169 }

170 finally {

171 context.setIsRunningPerformanceTrace(false);

172 }

173}

174/** We tell CrUXManager to fetch data so it's available when DevTools.PerformanceTraceFormatter is invoked */

175async function populateCruxData(result) {

176 logger?.('populateCruxData called');

177 const cruxManager = DevTools.CrUXManager.CrUXManager.instance();

178 // go/jtfbx. Yes, we're aware this API key is public. ;)

179 cruxManager.setEndpointForTesting('https://chromeuxreport.googleapis.com/v1/records:queryRecord?key=AIzaSyBn5gimNjhiEyA_euicSKko6IlD3HdgUfk');

High

High Secret

Package contains a high-severity secret pattern.

build/src/tools/performance.jsView on unpkg · L179

High

Secret Pattern

Google API key in build/src/tools/performance.js

build/src/tools/performance.jsView on unpkg · L179

180 const cruxSetting = DevTools.Common.Settings.Settings.instance().createSetting('field-data', {

181 enabled: true,

182 });

183 cruxSetting.set({ enabled: true });

184 // Gather URLs to fetch CrUX data for

185 const urls = [...(result.parsedTrace.insights?.values() ?? [])].map(c => c.url.toString());

186 urls.push(result.parsedTrace.data.Meta.mainFrameURL);

187 const urlSet = new Set(urls);

188 if (urlSet.size === 0) {

189 logger?.('No URLs found for CrUX data');

190 return;

191 }

192 logger?.(`Fetching CrUX data for ${urlSet.size} URLs: ${Array.from(urlSet).join(', ')}`);

193 const cruxData = await Promise.all(Array.from(urlSet).map(async (url) => {

194 const data = await cruxManager.getFieldDataForPage(url);

195 logger?.(`CrUX data for ${url}: ${data ? 'found' : 'not found'}`);

196 return data;

197 }));

198 result.parsedTrace.metadata.cruxFieldData = cruxData;

199}

build/src/third_party/devtools-formatter-worker.jsView file

8376} L8377: eval(val) { L8378: const sign = val < 0 ? -1 : 1.0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/src/third_party/devtools-formatter-worker.jsView on unpkg · L8376

build/src/third_party/lighthouse-devtools-mcp-bundle.jsView file

•path = build/src/third_party/lighthouse-devtools-mcp-bundle.js kind = oversized_source_file sizeBytes = 8475771 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/src/third_party/lighthouse-devtools-mcp-bundle.jsView on unpkg