registry / claude-cup / 0.9.10

claude-cup@0.9.10

Claude Cup — Anthropic worldwide building contest. Visual trophy in your terminal that fills based on your Build Rate. Real-time worldwide leaderboard, MCP/hook integration with Claude Code, eco mode, beautiful Anthropic-styled UI.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 569 KB of source, external domains: api.anthropic.com, api.claude-cup.com

Source & flagged code

2 flagged

mcp-server/dist/mcp-server.mjsView file

Lines 1-19javascript

1#!/usr/bin/env node

2// claude-cup MCP launcher (copied to ~/.claude-jar/mcp-server.mjs on registration)

3// This is the entry registered in ~/.claude/settings.json (and Cursor equivalents).

4// It supports both long-lived stdio MCP server mode and short-lived --hook mode.

5// The source path is baked in at build time so the launcher works from any directory.

7import { pathToFileURL } from 'node:url';

8const SRC = "C:\\Users\\itaib\\nice claude iedeas\\Claude-\\claude-jar\\mcp-server\\src";

9const toURL = f => pathToFileURL(f).href;

10const isHook = process.argv.includes('--hook');

12if (isHook) {

13 const { runHookIngest } = await import(toURL(SRC + '/hook-ingest.js'));

14 await runHookIngest(process.argv);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server/dist/mcp-server.mjsView on unpkg · L12

15} else {

16 const { startMcpServer } = await import(toURL(SRC + '/index.js'));

17 await startMcpServer();

18}

src/cli.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2process.title = 'claude-cup';

3// Force the terminal tab/window title to "claude-cup" via OSC sequences.

4// We emit BOTH OSC 0 (icon name + window title) and OSC 2 (window title only)

5// with both BEL and ST terminators so Windows Terminal, ConPTY, VS Code, and

6// Cursor all pick it up. This overrides any folder-name or AWS-profile prefix

7// inherited from the parent shell.

8if (process.stdout && process.stdout.isTTY) {

Source & flagged code

2 flagged · loading source

mcp-server/dist/mcp-server.mjsView file

12if (isHook) { L13: const { runHookIngest } = await import(toURL(SRC + '/hook-ingest.js')); L14: await runHookIngest(process.argv);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp-server/dist/mcp-server.mjsView on unpkg · L12

src/cli.jsView file

7Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L7: // inherited from the parent shell. L8: if (process.stdout && process.stdout.isTTY) { L9: try { L10: process.stdout.write('\x1b]0;claude-cup\x07'); L11: process.stdout.write('\x1b]2;claude-cup\x07'); ... L25: import { fileURLToPath } from 'node:url'; L26: import { spawn } from 'node:child_process'; L27: import { Aggregator } from './aggregator.js'; ... L123: try { L124: if (process.platform === 'win32') { L125: spawn('cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' }).unref(); ... L194:

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

src/cli.jsView on unpkg · L7

Findings

1 High4 Medium5 Low

HighEntrypoint Build Divergencesrc/cli.js

MediumDynamic Requiremcp-server/dist/mcp-server.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings