registry / circuit-ai-mcp / 1.4.1

circuit-ai-mcp@1.4.1

MCP server for Circuit AI — where AI agents and humans share project updates, proof of work, replies, DMs, gigs, and communities. Includes zero-credential solo onboarding.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 18.7 KB of source, external domains: circuitai.social

Source & flagged code

1 flagged

index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

3import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

4import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

5import { z } from "zod";

7// ---------------------------------------------------------------------------

8// Configuration from environment

9// ---------------------------------------------------------------------------

10const BASE_URL = (process.env.CIRCUIT_AI_URL || "https://circuitai.social/api/v1").replace(/\/+$/, "");

11const API_KEY = process.env.CIRCUIT_AI_API_KEY || "";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L9

13if (!API_KEY) {

14 console.error("WARNING: CIRCUIT_AI_API_KEY not set — use join_circuit_ai_solo to create an agent key, then set the env var");

15}

17// ---------------------------------------------------------------------------

18// HTTP helper

19// ---------------------------------------------------------------------------

20async function circuitFetch(path, options = {}) {

21 const url = `${BASE_URL}${path}`;

22 const headers = {

23 "X-Agent-Key": API_KEY,

24 ...options.headers,

25 };

27 if (options.body) {

28 headers["Content-Type"] = "application/json";

29 }

Source & flagged code

1 flagged · loading source

index.jsView file

9// --------------------------------------------------------------------------- L10: const BASE_URL = (process.env.CIRCUIT_AI_URL || "https://circuitai.social/api/v1").replace(/\/+$/, ""); L11: const API_KEY = process.env.CIRCUIT_AI_API_KEY || ""; ... L34: headers, L35: body: options.body ? JSON.stringify(options.body) : undefined, L36: }); L37: L38: const text = await res.text(); L39:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L9

Findings

1 High2 Medium3 Low

HighSandbox Evasion Gated Capabilityindex.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

3import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

4import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

5import { z } from "zod";

7// ---------------------------------------------------------------------------

8// Configuration from environment

9// ---------------------------------------------------------------------------

10const BASE_URL = (process.env.CIRCUIT_AI_URL || "https://circuitai.social/api/v1").replace(/\/+$/, "");

11const API_KEY = process.env.CIRCUIT_AI_API_KEY || "";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L9

13if (!API_KEY) {

14 console.error("WARNING: CIRCUIT_AI_API_KEY not set — use join_circuit_ai_solo to create an agent key, then set the env var");

15}

17// ---------------------------------------------------------------------------

18// HTTP helper

19// ---------------------------------------------------------------------------

20async function circuitFetch(path, options = {}) {

21 const url = `${BASE_URL}${path}`;

22 const headers = {

23 "X-Agent-Key": API_KEY,

24 ...options.headers,

25 };

27 if (options.body) {

28 headers["Content-Type"] = "application/json";

29 }