registry / converse-mcp-server / 2.29.2

converse-mcp-server@2.29.2

Converse MCP Server - Converse with other LLMs with chat and consensus tools

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 762 KB of source, external domains: antigravity.google, api.deepseek.com, api.x.ai, github.com, openrouter.ai

Source & flagged code

2 flagged

bin/converse.jsView file

Lines 18-48javascript

18 ? process.argv[cwdArgIndex + 1]

19 : process.cwd();

21// Expose as env var so config.js can pick it up (only if not already set)

22if (!process.env.CLIENT_CWD) {

23 process.env.CLIENT_CWD = callerCwd;

24}

26// Get the directory of this script

27const __filename = fileURLToPath(import.meta.url);

28const __dirname = dirname(__filename);

30// Get the project root (parent of bin directory)

31const projectRoot = dirname(__dirname);

33// Change working directory to project root so Node.js can find dependencies

34process.chdir(projectRoot);

36// Import and start the server

37try {

38 const indexPath = join(projectRoot, 'src/index.js');

39 const { main } = await import(pathToFileURL(indexPath).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/converse.jsView on unpkg · L38

41 // The main function will handle all logging appropriately based on transport type

42 await main();

43} catch (error) {

44 // For stdio transport, we must not output anything to stdout

45 // For http transport, this will be logged by the error handler in main

46 // Just exit with error code

47 process.exit(1);

48}

src/providers/gemini-cli.jsView file

Lines 360-400javascript

360 return segments[segments.length - 1];

361 })

362 .join('\n');

363

364 // Strip any remaining lone control chars (BEL, etc.) except tab and newline.

365 s = s.replace(/[\x00-\x08\x0b-\x1f\x7f]/g

Source & flagged code

2 flagged · loading source

bin/converse.jsView file

38const indexPath = join(projectRoot, 'src/index.js'); L39: const { main } = await import(pathToFileURL(indexPath).href); L40:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/converse.jsView on unpkg · L38

src/providers/gemini-cli.jsView file

380package = converse-mcp-server; repositoryIdentity = converse; dependency = @lydell/node-pty L380: try { L381: const mod = await import('@lydell/node-pty'); L382: return mod.default || mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/providers/gemini-cli.jsView on unpkg · L380

Findings

1 High4 Medium4 Low

HighCopied Package Dependency Bridgesrc/providers/gemini-cli.js

MediumDynamic Requirebin/converse.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/converse.jsView file

Lines 18-48javascript

18 ? process.argv[cwdArgIndex + 1]

19 : process.cwd();

21// Expose as env var so config.js can pick it up (only if not already set)

22if (!process.env.CLIENT_CWD) {

23 process.env.CLIENT_CWD = callerCwd;

24}

26// Get the directory of this script

27const __filename = fileURLToPath(import.meta.url);

28const __dirname = dirname(__filename);

30// Get the project root (parent of bin directory)

31const projectRoot = dirname(__dirname);

33// Change working directory to project root so Node.js can find dependencies

34process.chdir(projectRoot);

36// Import and start the server

37try {

38 const indexPath = join(projectRoot, 'src/index.js');

39 const { main } = await import(pathToFileURL(indexPath).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/converse.jsView on unpkg · L38

41 // The main function will handle all logging appropriately based on transport type

42 await main();

43} catch (error) {

44 // For stdio transport, we must not output anything to stdout

45 // For http transport, this will be logged by the error handler in main

46 // Just exit with error code

47 process.exit(1);

48}

src/providers/gemini-cli.jsView file

Lines 360-400javascript

360 return segments[segments.length - 1];

361 })

362 .join('\n');

363

364 // Strip any remaining lone control chars (BEL, etc.) except tab and newline.

365 s = s.replace(/[\x00-\x08\x0b-\x1f\x7f]/g