registry / cortex-rmcp / 3.9.1

cortex-rmcp@3.9.1

Node launcher for the cortex Rust MCP server, CLI, and homelab intelligence binary.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 4.80 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 6-43json

6 "homepage": "https://github.com/jmagar/cortex#readme",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/jmagar/cortex.git",

10 "directory": "packages/cortex-rmcp"

11 },

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cortex.jsView file

4const path = require("node:path"); L5: const { spawnSync } = require("node:child_process"); L6: const { binaryPath } = require("../lib/platform");

High

Child Process

Package source references child process execution.

bin/cortex.jsView on unpkg · L4

scripts/install.jsView file

3const fs = require("node:fs"); L4: const http = require("node:http"); L5: const https = require("node:https"); ... L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: const { binaryPath, downloadUrl, installRoot, releaseVersion, targetFor } = require("../lib/platform"); ... L13: function extract(archive,destination,target) { fs.rmSync(destination,{recursive:true,force:true}); fs.mkdirSync(destination,{recursive:true}); if(target.archiveType==="zip") { if(p... L14: async function main() { if(process.env.CORTEX_RMCP_SKIP_DOWNLOAD==="1") { log("skipping binary download because CORTEX_RMCP_SKIP_DOWNLOAD=1"); return; } const target=targetFor(); c... L15: main().catch((error)=>{ log(error.message); process.exitCode=1; });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L3

Findings

3 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cortex.js

HighSame File Env Network Executionscripts/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin/cortex.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2"use strict";

3const fs = require("node:fs");

4const path = require("node:path");

5const { spawnSync } = require("node:child_process");

6const { binaryPath } = require("../lib/platform");

High

Child Process

Package source references child process execution.

bin/cortex.jsView on unpkg · L4

7function fail(message) { process.stderr.write(`cortex-rmcp: ${message}\n`); process.exit(1); }

8const binary = binaryPath();

9if (!fs.existsSync(binary)) { const installer = path.resolve(__dirname, "..", "scripts", "install.js"); const install = spawnSync(process.execPath, [installer], { stdio: "inherit" }); if (install.status !== 0) fail("binary is not installed; postinstall may have failed"); }

10const child = spawnSync(binary, process.argv.slice(2), { stdio: "inherit" });

11if (child.error) fail(child.error.message);

12if (child.signal) process.kill(process.pid, child.signal); else process.exit(child.status ?? 1);

scripts/install.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

2"use strict";

3const fs = require("node:fs");

4const http = require("node:http");

5const https = require("node:https");

6const os = require("node:os");

7const path = require("node:path");

8const { spawnSync } = require("node:child_process");

9const { binaryPath, downloadUrl, installRoot, releaseVersion, targetFor } = require("../lib/platform");

10function log(message) { process.stderr.write(`cortex-rmcp: ${message}\n`); }

11function download(url, destination) { return new Promise((resolve,reject)=>{ const client = url.startsWith("http:") ? http : https; const request=client.get(url,(response)=>{ if([301,302,

12function run(command,args) { const result=spawnSync(command,args,{encoding:"utf8"}); if(result.status!==0) throw new Error((result.stderr || result.stdout || `${command} failed`).trim()); }

13function extract(archive,destination,target) { fs.rmSync(destination,{recursive:true,force:true}); fs.mkdirSync(destination,{recursive:true}); if(target.archiveType==="zip") { if(process.platform==="win32") run("powershell.exe",["-NoProfile","-Command",`Expand-Archive -LiteralPath '${archive.replace(/'/g,"''")

14async function main() { if(process.env.CORTEX_RMCP_SKIP_DOWNLOAD==="1") { log("skipping binary download because CORTEX_RMCP_SKIP_DOWNLOAD=1"); return; } const target=targetFor(); const destination=binaryPath(); if(fs.existsSync(destination)) { log(`${path.basename(destination)} already installed for ${releaseVersion()}`);

15main().catch((error)=>{ log(error.message); process.exitCode=1; });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L3

Long lines were clipped for display.