registry / cortex-rmcp / 3.11.1

cortex-rmcp@3.11.1

Node launcher for Cortex, a Rust MCP/HTTP log aggregation and AI transcript correlation platform.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 24.1 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 9-49json

9 "url": "git+https://github.com/jmagar/cortex.git",

10 "directory": "packages/cortex-rmcp"

11 },

12 "bugs": {

13 "url": "https://github.com/jmagar/cortex/issues"

14 },

15 "bin": {

16 "cortex-rmcp": "bin/cortex.js",

17 "cortex": "bin/cortex.js"

18 },

19 "files": [

20 "bin/",

21 "lib/",

22 "scripts/",

23 "README.md",

24 "LICENSE*",

25 "package.json"

26 ],

27 "scripts": {

28 "prepack": "node scripts/sync-readme.js",

29 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test": "node --test",

31 "check": "node --check bin/cortex.js && node --check scripts/install.js && node --check lib/platform.js && node --check scripts/sync-readme.js && node --check scripts/check-package.js && node scripts/check-package.js",

32 "prepublishOnly": "node scripts/check-package.js --release"

33 },

34 "engines": {

35 "node": ">=18"

36 },

37 "keywords": [

38 "mcp",

39 "mcp-server",

40 "model-context-protocol",

41 "rust",

42 "self-hosted",

43 "claude-code",

44 "codex",

45 "gemini",

46 "homelab",

47 "logs",

48 "observability",

49 "sqlite",

bin/cortex.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2"use strict";

3const fs = require("node:fs");

4const path = require("node:path");

Medium

scripts/check-package.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cortex-rmcp@3.10.0 matchedIdentity = npm:Y29ydGV4LXJtY3A:3.10.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/check-package.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code