Loading npm security reports…
MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence
Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/tools/pattern-tools.jsView on unpkg · L454Package source references dynamic require/import behavior.
dist/tools/wiki-lint.jsView on unpkg · L45Package source references weak cryptographic algorithms.
dist/tools/index-tools.jsView on unpkg · L3Package ships WebAssembly modules.
dist/parser/languages/tree-sitter-go.wasmView on unpkgPackage ships non-JavaScript build or shell helper files.
hooks/hook-chain.shView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L31Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L31Package ships WebAssembly modules.
dist/parser/languages/tree-sitter-go.wasmView on unpkgPackage ships non-JavaScript build or shell helper files.
hooks/hook-chain.shView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/tools/pattern-tools.jsView on unpkg · L454Package source references dynamic require/import behavior.
dist/tools/wiki-lint.jsView on unpkg · L45Package source references weak cryptographic algorithms.
dist/tools/index-tools.jsView on unpkg · L3