registry / dingdawg-shield / 1.0.8

dingdawg-shield@1.0.8

Governance receipts for AI agents — AI-driven security scanning with a stack-specific threat model, signed audit receipts for every scan, and trust scores that improve with verified fixes. Supports EU AI Act, Colorado AI Act (SB 24-205), and NIST AI RMF a

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 88.4 KB of source, external domains: api.dingdawg.com, dingdawg.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 30-70javascript

30 var ar = [];

31 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

32 return ar;

33 };

34 return ownKeys(o);

35 };

36 return function (mod) {

37 if (mod && mod.__esModule) return mod;

38 var result = {};

39 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

40 __setModuleDefault(result, mod);

41 return result;

42 };

43})();

44Object.defineProperty(exports, "__esModule", { value: true });

45const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");

46const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");

47const zod_1 = require("zod");

48const fs = __importStar(require("fs"));

49const os = __importStar(require("os"));

50const path = __importStar(require("path"));

51const API_BASE = process.env.DINGDAWG_API_URL || "https://api.dingdawg.com/v1";

52const API_KEY = process.env.DINGDAWG_API_KEY || "";

53// ---------------------------------------------------------------------------

54// Free-tier rate limits (per tool, per day, filesystem-persisted)

55// ---------------------------------------------------------------------------

56const FREE_TIER_LIMITS = {

57 security_scan_quick: 25, // 25 quick scans/day free

58};

59const RATE_FILE = path.join(os.homedir(), ".dingdawg", "shield_usage.json");

60function checkRateLimit(toolName) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L50

61 const limit = FREE_TIER_LIMITS[toolName];

62 if (limit === undefined)

63 return { allowed: true, remaining: Infinity };

64 const now = Date.now();

65 const dayMs = 86_400_000;

66 const key = `${toolName}:${new Date().toISOString().slice(0, 10)}`;

67 // Ensure directory exists

68 const dir = path.dirname(RATE_FILE);

69 if (!fs.existsSync(dir)) {

70 fs.mkdirSync(dir, { recursive: true });

Source & flagged code

1 flagged · loading source

dist/index.jsView file

50const path = __importStar(require("path")); L51: const API_BASE = process.env.DINGDAWG_API_URL || "https://api.dingdawg.com/v1"; L52: const API_KEY = process.env.DINGDAWG_API_KEY || ""; ... L58: }; L59: const RATE_FILE = path.join(os.homedir(), ".dingdawg", "shield_usage.json"); L60: function checkRateLimit(toolName) { ... L74: if (fs.existsSync(RATE_FILE)) { L75: store = JSON.parse(fs.readFileSync(RATE_FILE, "utf-8")); L76: } ... L129: headers: { "Content-Type": "application/json", Authorization: `Bearer ${API_KEY}` }, L130: body: JSON.stringify({ code_snippet, language, scan_depth: depth }), L131: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L50

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 30-70javascript

30 var ar = [];

31 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

32 return ar;

33 };

34 return ownKeys(o);

35 };

36 return function (mod) {

37 if (mod && mod.__esModule) return mod;

38 var result = {};

39 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

40 __setModuleDefault(result, mod);

41 return result;

42 };

43})();

44Object.defineProperty(exports, "__esModule", { value: true });

45const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");

46const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");

47const zod_1 = require("zod");

48const fs = __importStar(require("fs"));

49const os = __importStar(require("os"));

50const path = __importStar(require("path"));

51const API_BASE = process.env.DINGDAWG_API_URL || "https://api.dingdawg.com/v1";

52const API_KEY = process.env.DINGDAWG_API_KEY || "";

53// ---------------------------------------------------------------------------

54// Free-tier rate limits (per tool, per day, filesystem-persisted)

55// ---------------------------------------------------------------------------

56const FREE_TIER_LIMITS = {

57 security_scan_quick: 25, // 25 quick scans/day free

58};

59const RATE_FILE = path.join(os.homedir(), ".dingdawg", "shield_usage.json");

60function checkRateLimit(toolName) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L50

61 const limit = FREE_TIER_LIMITS[toolName];

62 if (limit === undefined)

63 return { allowed: true, remaining: Infinity };

64 const now = Date.now();

65 const dayMs = 86_400_000;

66 const key = `${toolName}:${new Date().toISOString().slice(0, 10)}`;

67 // Ensure directory exists

68 const dir = path.dirname(RATE_FILE);

69 if (!fs.existsSync(dir)) {

70 fs.mkdirSync(dir, { recursive: true });