registry / dodopayments-mcp / 2.41.0

dodopayments-mcp@2.41.0

The official MCP Server for the Dodo Payments API

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 3.64 MB of source, external domains: blogs.oracle.com, bun.sh, central.sonatype.com, cursor.com, deno.land, developer.android.com, docs.deno.com, docs.dodopayments.com, docs.oracle.com, docs.pydantic.dev, docs.python.org, endoflife.date, example.com, gemdocs.org, github.com, img.shields.io, javadoc.io, journal.stuffwithstuff.com, jsr.io, kotlinlang.org, live.dodopayments.com, my.test.proxy.example.com, my.test.server.example.com, npmjs.org, pkg.go.dev, pypi.org, semver.org, sorbet.org, square.github.io, www.github.com, www.guardsquare.com, www.npmjs.com, www.nuget.org, www.python-httpx.org

Source & flagged code

3 flagged

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.getInstructions = getInstructions;

8const promises_1 = __importDefault(require("fs/promises"));

9const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

10const INSTRUCTIONS_CACHE_TTL_MS = 15 * 60 * 1000; // 15 minutes

11const instructionsCache = new Map();

12async function getInstructions({ stainlessApiKey, customInstructionsPath, }) {

13 const now = Date.now();

14 const cacheKey = customInstructionsPath ?? stainlessApiKey ?? '';

15 const cached = instructionsCache.get(cacheKey);

16 if (cached && now - cached.fetchedAt <= INSTRUCTIONS_CACHE_TTL_MS) {

17 return cached.fetchedInstructions;

18 }

19 // Evict stale entries so the cache doesn't grow unboundedly.

20 for (const [key, entry] of instructionsCache) {

21 if (now - entry.fetchedAt > INSTRUCTIONS_CACHE_TTL_MS) {

22 instructionsCache.delete(key);

23 }

24 }

25 let fetchedInstructions;

26 if (customInstructionsPath) {

27 fetchedInstructions = await fetchLatestInstructionsFromFile(customInstructionsPath);

package.jsonView file

Lines 1-41json

2 "name": "dodopayments-mcp",

3 "version": "2.41.0",

4 "description": "The official MCP Server for the Dodo Payments API",

5 "author": "Dodo Payments <support@dodopayments.com>",

6 "types": "./index.d.ts",

7 "main"

Source & flagged code

3 flagged · loading source

instructions.jsView file

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

1 Critical4 Medium4 Low

CriticalManifest Confusionpackage.json

MediumDynamic Requireinstructions.js

MediumNetwork

MediumEnvironment Vars

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.getInstructions = getInstructions;

8const promises_1 = __importDefault(require("fs/promises"));

9const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

10const INSTRUCTIONS_CACHE_TTL_MS = 15 * 60 * 1000; // 15 minutes

11const instructionsCache = new Map();

12async function getInstructions({ stainlessApiKey, customInstructionsPath, }) {

13 const now = Date.now();

14 const cacheKey = customInstructionsPath ?? stainlessApiKey ?? '';

15 const cached = instructionsCache.get(cacheKey);

16 if (cached && now - cached.fetchedAt <= INSTRUCTIONS_CACHE_TTL_MS) {

17 return cached.fetchedInstructions;

18 }

19 // Evict stale entries so the cache doesn't grow unboundedly.

20 for (const [key, entry] of instructionsCache) {

21 if (now - entry.fetchedAt > INSTRUCTIONS_CACHE_TTL_MS) {

22 instructionsCache.delete(key);

23 }

24 }

25 let fetchedInstructions;

26 if (customInstructionsPath) {

27 fetchedInstructions = await fetchLatestInstructionsFromFile(customInstructionsPath);

package.jsonView file

Lines 1-41json

2 "name": "dodopayments-mcp",

3 "version": "2.41.0",

4 "description": "The official MCP Server for the Dodo Payments API",

5 "author": "Dodo Payments <support@dodopayments.com>",

6 "types": "./index.d.ts",

7 "main"