registry / codesift-mcp / 0.15.0

codesift-mcp@0.15.0

MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 21 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 638 file(s), 3.48 MB of source, external domains: api.openai.com, api.osv.dev, api.voyageai.com, cdn.jsdelivr.net, coding.tgmedit.com, docs.astro.build, github.com, huggingface.co, pypi.org, rollupjs.org, vite.dev, yourdomain.com, zod.dev

Source & flagged code

13 flagged

package.jsonView file

Lines 11-51json

11 },

12 "main": "./dist/server.js",

13 "files": [

14 "dist",

15 "rules",

16 "hooks",

17 "src/parser/languages",

18 "README.md",

19 "LICENSE"

20 ],

21 "scripts": {

22 "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc && cp -r src/parser/languages dist/parser/ && chmod +x dist/cli.js dist/server.js && node scripts/restart-daemon-after-build.mjs",

23 "dev": "tsx src/server.ts",

24 "start": "node dist/server.js",

25 "test": "vitest run",

26 "test:watch": "vitest",

27 "test:coverage": "vitest run --coverage",

28 "lint": "biome lint . && tsc --noEmit",

29 "download-wasm": "tsx scripts/download-wasm.ts",

30 "prepublishOnly": "npm run build && npm test",

31 "postinstall": "node ./dist/cli.js setup all 2>/dev/null && echo '\n ✨ CodeSift MCP installed and configured for all platforms.\n ⚠️ Restart your AI client (Cmd+Q for Claude Code) to load new MCP server.\n' || echo '\n ✨ CodeSift MCP installed. Run: codesift setup all\n'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "lint:fix": "biome lint --write . && tsc --noEmit"

33 },

34 "dependencies": {

35 "@manypkg/get-packages": "^3.1.0",

36 "@modelcontextprotocol/core": "^2.0.0",

37 "@modelcontextprotocol/node": "^2.0.0",

38 "@modelcontextprotocol/sdk": "^1.0.0",

39 "@modelcontextprotocol/server": "^2.0.0",

40 "@mrleebo/prisma-ast": "^0.15.0",

41 "@parcel/watcher": "^2.5.6",

42 "@sanity-labs/secret-scan": "^1.1.0",

43 "get-tsconfig": "^4.14.0",

44 "graphology": "^0.26.0",

45 "graphology-metrics": "^2.4.0",

46 "ignore": "^6.0.0",

47 "picomatch": "^4.0.4",

48 "web-tree-sitter": "^0.26.11",

49 "zod": "^4.3.6"

50 },

51 "optionalDependencies": {

dist/tools/patterns/adapters/php.jsView file

Lines 1-31javascript

1export const PHP_PATTERNS = {

2 "sql-injection-php": {

3 regex: /\$_(?:GET|POST|REQUEST)\[[^\]]+\][\s\S]{0,200}?(?:->query\(

dist/tools/pg-introspection.jsView file

Lines 1-33javascript

1/**

2 * PostgreSQL introspection tools.

3 * `pg` is an optional dependency — all imports are dynamic so the module

4 * loads cleanly even when `pg` is not installed.

5 */

6import { buildRelationships, buildTables } from "./pg-introspect-formatters.js";

7export async function loadPgClient

dist/tools/index-tools/snapshots.jsView file

Lines 98-138javascript

98 });

99 }

100 return result;

101}

102export const ASTRO_LOCK_FILENAME = "astro-reindex.lock";

103export const

dist/cli/service.jsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, existsSync, unlinkSync } from "node:fs";

2import { homedir, platform } from "node:os";

3import { join, dirname } from "node:path";

4import { isLoopbackHost } from "../utils/loopback.js";

dist/parser/languages/tree-sitter-go.wasmView file

•path = dist/parser/languages/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parser/languages/tree-sitter-go.wasmView on unpkg

hooks/hook-chain.shView file

•path = hooks/hook-chain.sh kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook-chain.shView on unpkg

dist/server.jsView file

•matchType = normalized_sha256 matchedPackage = codesift-mcp@0.14.0 matchedPath = dist/server.js matchedIdentity = npm:Y29kZXNpZnQtbWNw:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High