registry / copilot-money-mcp / 2.3.0

copilot-money-mcp@2.3.0

MCP server for Copilot Money — query personal finances locally (14 cache-mode read tools), opt into GraphQL-backed live reads with --live-reads (21 read tools: 8 cache + 13 live), and manage data via Copilot's GraphQL API (17 write tools, opt-in with --wr

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 3 file(s), 3.41 MB of source, external domains: app.copilot.money, github.com, json-schema.org, raw.githubusercontent.com, securetoken.googleapis.com

Source & flagged code

5 flagged

dist/server.jsView file

40963patternName = google_api_key severity = high line = 40963 matchedText = var FIRE...pk";

High

High Secret

Package contains a high-severity secret pattern.

dist/server.jsView on unpkg · L40963

40963patternName = google_api_key severity = high line = 40963 matchedText = var FIRE...pk";

High

Secret Pattern

Google API key in dist/server.js

dist/server.jsView on unpkg · L40963

2890sourceCode = this.opts.code.process(sourceCode, sch); L2891: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2892: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L2890

dist/launcher.shView file

•path = dist/launcher.sh kind = build_helper sizeBytes = 1564 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/launcher.shView on unpkg

dist/cli.jsView file

40964patternName = google_api_key severity = high line = 40964 matchedText = var FIRE...pk";

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L40964

Source & flagged code

5 flagged · loading source

dist/server.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code