registry / dingdawg-governance / 2.1.8

dingdawg-governance@2.1.8

Governance receipts for AI agents — universal, MCP-native, fail-closed governance layer compliant with EU AI Act Art. 12, Colorado AI Act (SB 24-205), and NIST AI RMF. LNN interpretability, IPFS audit proofs, and rollback for any agent in any framework.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 80.7 KB of source, external domains: api.dingdawg.com, checkout.dingdawg.com, dingdawg.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 33-73javascript

33 };

34 return ownKeys(o);

35 };

36 return function (mod) {

37 if (mod && mod.__esModule) return mod;

38 var result = {};

39 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

40 __setModuleDefault(result, mod);

41 return result;

42 };

43})();

44Object.defineProperty(exports, "__esModule", { value: true });

45const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");

46const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");

47const zod_1 = require("zod");

48const fs = __importStar(require("fs"));

49const os = __importStar(require("os"));

50const path = __importStar(require("path"));

51const crypto = __importStar(require("crypto"));

52const lnn_interpretability_js_1 = require("./lnn_interpretability.js");

53const meter_tools_js_1 = require("./meter_tools.js");

54const API_BASE = process.env.DINGDAWG_API_URL || "https://api.dingdawg.com/v1";

55const API_KEY = process.env.DINGDAWG_API_KEY || "";

56// ---------------------------------------------------------------------------

57// Filesystem paths

58// ---------------------------------------------------------------------------

59const GOV_DIR = path.join(os.homedir(), ".dingdawg", "governance");

60const RECEIPTS_DIR = path.join(GOV_DIR, "receipts");

61const RATE_FILE = path.join(os.homedir(), ".dingdawg", "governance_usage.json");

62function ensureDirs() {

63 if (!fs.existsSync(RECEIPTS_DIR)) {

64 fs.mkdirSync(RECEIPTS_DIR, { recursive: true });

65 }

66}

67// ---------------------------------------------------------------------------

68// Persistent rate limiting — same pattern as dingdawg-compliance

69// ---------------------------------------------------------------------------

70const MACHINE_ID = crypto.createHash("sha256")

71 .update(`${os.hostname()}-${os.userInfo().username}-${os.platform()}-${os.arch()}`)

72 .digest("hex").slice(0, 16);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L53

73function checkFreeRateLimit(tool, limit) {

Source & flagged code

1 flagged · loading source

dist/index.jsView file

53const meter_tools_js_1 = require("./meter_tools.js"); L54: const API_BASE = process.env.DINGDAWG_API_URL || "https://api.dingdawg.com/v1"; L55: const API_KEY = process.env.DINGDAWG_API_KEY || ""; ... L58: // --------------------------------------------------------------------------- L59: const GOV_DIR = path.join(os.homedir(), ".dingdawg", "governance"); L60: const RECEIPTS_DIR = path.join(GOV_DIR, "receipts"); ... L70: const MACHINE_ID = crypto.createHash("sha256") L71: .update(`${os.hostname()}-${os.userInfo().username}-${os.platform()}-${os.arch()}`) L72: .digest("hex").slice(0, 16); ... L82: if (fs.existsSync(RATE_FILE)) { L83: store = JSON.parse(fs.readFileSync(RATE_FILE, "utf-8")); L84: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L53

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 33-73javascript

33 };

34 return ownKeys(o);

35 };

36 return function (mod) {

37 if (mod && mod.__esModule) return mod;

38 var result = {};

39 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

40 __setModuleDefault(result, mod);

41 return result;

42 };

43})();

44Object.defineProperty(exports, "__esModule", { value: true });

45const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");

46const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");

47const zod_1 = require("zod");

48const fs = __importStar(require("fs"));

49const os = __importStar(require("os"));

50const path = __importStar(require("path"));

51const crypto = __importStar(require("crypto"));

52const lnn_interpretability_js_1 = require("./lnn_interpretability.js");

53const meter_tools_js_1 = require("./meter_tools.js");

54const API_BASE = process.env.DINGDAWG_API_URL || "https://api.dingdawg.com/v1";

55const API_KEY = process.env.DINGDAWG_API_KEY || "";

56// ---------------------------------------------------------------------------

57// Filesystem paths

58// ---------------------------------------------------------------------------

59const GOV_DIR = path.join(os.homedir(), ".dingdawg", "governance");

60const RECEIPTS_DIR = path.join(GOV_DIR, "receipts");

61const RATE_FILE = path.join(os.homedir(), ".dingdawg", "governance_usage.json");

62function ensureDirs() {

63 if (!fs.existsSync(RECEIPTS_DIR)) {

64 fs.mkdirSync(RECEIPTS_DIR, { recursive: true });

65 }

66}

67// ---------------------------------------------------------------------------

68// Persistent rate limiting — same pattern as dingdawg-compliance

69// ---------------------------------------------------------------------------

70const MACHINE_ID = crypto.createHash("sha256")

71 .update(`${os.hostname()}-${os.userInfo().username}-${os.platform()}-${os.arch()}`)

72 .digest("hex").slice(0, 16);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L53

73function checkFreeRateLimit(tool, limit) {