registry / drafted / 1.11.36

drafted@1.11.36

Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 320 KB of source, external domains: drafted.live, fonts.googleapis.com, fonts.gstatic.com

Source & flagged code

4 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Drafted MCP Server

5 * Filesystem-style tools for agents to read/write/edit frames on the canvas.

6 * Calls the Drafted HTTP API directly (no CLI subprocess).

7 */

9import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';

10import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

11import { execFile } from 'child_process';

12import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

mcp/server.mjsView on unpkg · L10

13import { readFileSync, existsSync, realpathSync, writeFileSync, mkdirSync, unlinkSync, appendFileSync, readdirSync, statSync } from 'fs';

14import { join, dirname, basename, extname, resolve } from 'path';

15import { homedir, platform, release as osRelease, arch as osArch } from 'os';

16import { fileURLToPath } from 'url';

17import { AsyncLocalStorage } from 'node:async_hooks';

18import { z } from 'zod';

19import { registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';

20import WebSocket from 'ws';

21import { LAYERS } from '../src/shared/constants.mjs';

22import { emptyExcalidrawScene, excalidrawSceneFromMermaid, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';

23import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';

24import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';

26// Frame actions that mutate content — gated by G1 (wiki search before editing).

27// Read-style actions (read, search, versions, get_*/read_*) are exempt.

28const G1_MUTATING_FRAME_ACTIONS = new Set([

29 'write', 'write_excalidraw', 'edit', 'mv', 'anchor', 'restore_version',

30 'write_sheet_values', 'append_sheet_rows', 'clear_sheet_range', 'update_sheet',

Lines 1896-1936javascript

1896 action: 'update_mcp',

1897 started: false,

1898 updateSupported: false,

1899 mode,

1900 currentVersion: updateMetadata?.currentVersion || PACKAGE_VERSION,

1901 latestVersion: updateMetadata?.latestVersion || null,

1902 updateAvailable

cli/drafted.mjsView file

Lines 144-184javascript

144function readConfigServer() {

145 try {

146 if (existsSync(DEFAULT_CONFIG_FILE)) {

147 const cfg = JSON.parse(readFileSync(DEFAULT_CONFIG_FILE, 'utf8'));

148

install-mcp.shView file

•path = install-mcp.sh kind = build_helper sizeBytes = 50326 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-mcp.shView on unpkg

Source & flagged code

4 flagged · loading source

mcp/server.mjsView file

10import { StdioServerTransport } from '@[redacted].js'; L11: import { execFile } from 'child_process'; L12: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

mcp/server.mjsView on unpkg · L10

1916const manualCommand = platform() === 'win32' L1917: ? `$tmp = Join-Path $env:TEMP "drafted-install.ps1"; Invoke-WebRequest -UseBasicParsing "${server}/install.ps1" -OutFile $tmp; powershell -NoProfile -ExecutionPolicy Bypass -File $... L1918: : `tmp=$(mktemp); curl -fsSL ${server}/install.sh -o "$tmp" && bash "$tmp"`;

High

Shell

Package source references shell execution.

mcp/server.mjsView on unpkg · L1916

cli/drafted.mjsView file

164function getServerUrl() { L165: if (process.env.DRAFTED_SERVER) { L166: return process.env.DRAFTED_SERVER.replace(/\/$/, ''); ... L171: if (fromConfig) return String(fromConfig).replace(/\/$/, ''); L172: return `http://localhost:${process.env.DRAFTED_PORT || DEFAULT_PORT}`; L173: } ... L177: if (platform() === 'win32') { L178: const script = `$tmp = Join-Path $env:TEMP "drafted-install.ps1"; Invoke-WebRequest -UseBasicParsing "${server}/install.ps1" -OutFile $tmp; powershell -NoProfile -ExecutionPolicy B... L179: return {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/drafted.mjsView on unpkg · L164

install-mcp.shView file

•path = install-mcp.sh kind = build_helper sizeBytes = 50326 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-mcp.shView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processmcp/server.mjs

HighShellmcp/server.mjs

HighSame File Env Network Executioncli/drafted.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-mcp.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Drafted MCP Server

5 * Filesystem-style tools for agents to read/write/edit frames on the canvas.

6 * Calls the Drafted HTTP API directly (no CLI subprocess).

7 */

9import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';

10import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

11import { execFile } from 'child_process';

12import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

mcp/server.mjsView on unpkg · L10

13import { readFileSync, existsSync, realpathSync, writeFileSync, mkdirSync, unlinkSync, appendFileSync, readdirSync, statSync } from 'fs';

14import { join, dirname, basename, extname, resolve } from 'path';

15import { homedir, platform, release as osRelease, arch as osArch } from 'os';

16import { fileURLToPath } from 'url';

17import { AsyncLocalStorage } from 'node:async_hooks';

18import { z } from 'zod';

19import { registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';

20import WebSocket from 'ws';

21import { LAYERS } from '../src/shared/constants.mjs';

22import { emptyExcalidrawScene, excalidrawSceneFromMermaid, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';

23import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';

24import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';

26// Frame actions that mutate content — gated by G1 (wiki search before editing).

27// Read-style actions (read, search, versions, get_*/read_*) are exempt.

28const G1_MUTATING_FRAME_ACTIONS = new Set([

29 'write', 'write_excalidraw', 'edit', 'mv', 'anchor', 'restore_version',

30 'write_sheet_values', 'append_sheet_rows', 'clear_sheet_range', 'update_sheet',

Lines 1896-1936javascript

1896 action: 'update_mcp',

1897 started: false,

1898 updateSupported: false,

1899 mode,

1900 currentVersion: updateMetadata?.currentVersion || PACKAGE_VERSION,

1901 latestVersion: updateMetadata?.latestVersion || null,

1902 updateAvailable

cli/drafted.mjsView file

Lines 144-184javascript

144function readConfigServer() {

145 try {

146 if (existsSync(DEFAULT_CONFIG_FILE)) {

147 const cfg = JSON.parse(readFileSync(DEFAULT_CONFIG_FILE, 'utf8'));

148

install-mcp.shView file

•path = install-mcp.sh kind = build_helper sizeBytes = 50326 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-mcp.shView on unpkg