registry / drafted / 1.14.1

drafted@1.14.1

Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 354 KB of source, external domains: drafted.live, fonts.googleapis.com, fonts.gstatic.com

Source & flagged code

5 flagged

mcp/server.mjsView file

Lines 1-56javascript

1#!/usr/bin/env node

3/**

4 * Drafted MCP Server

5 * Filesystem-style tools for agents to read/write/edit frames on the canvas.

6 * Calls the Drafted HTTP API directly (no CLI subprocess).

7 */

9import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';

10import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

11import { execFile } from 'child_process';

12import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

mcp/server.mjsView on unpkg · L10

13import { readFileSync, existsSync, realpathSync, writeFileSync, mkdirSync, unlinkSync, appendFileSync, readdirSync, statSync } from 'fs';

14import { join, dirname, basename, extname, resolve } from 'path';

15import { homedir, platform, release as osRelease, arch as osArch } from 'os';

16import { fileURLToPath } from 'url';

17import { AsyncLocalStorage } from 'node:async_hooks';

18import { z } from 'zod';

19import { registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';

20import WebSocket from 'ws';

21import { LAYERS } from '../src/shared/constants.mjs';

22import { emptyExcalidrawScene, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';

23import { formatOkfLogEntry, appendOkfLogEntry } from '../src/shared/okf-log.mjs';

24import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';

25import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';

27// Frame actions that mutate content — gated by G1 (wiki search before editing).

28// Read-style actions (read, search, versions, get_*/read_*) are exempt.

29const G1_MUTATING_FRAME_ACTIONS = new Set([

30 'write', 'write_excalidraw', 'edit', 'mv', 'anchor', 'restore_version',

31 'write_sheet_values', 'append_sheet_rows', 'clear_sheet_range', 'update_sheet',

32 'write_doc_content', 'append_doc_content', 'clear_doc_content', 'update_doc',

33 'write_slide_content', 'append_slides', 'clear_slides', 'update_slide',

34]);

35const { UMAMI_EVENTS, trackUmamiEvent } = await (async () => {

36 try {

37 return await import('../server/lib/umami.mjs');

38 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp/server.mjsView on unpkg · L36

39 return {

40 UMAMI_EVENTS: Object.freeze({

41 MCP_CONNECTED: 'mcp_connected',

42 MCP_TOOL_CALLED: 'mcp_tool_called',

43 DRAFTED_MCP_REQUEST: 'drafted_mcp_request',

44 DRAFTED_MCP_ERROR: 'drafted_mcp_error',

45 }),

46 trackUmamiEvent: () => {},

47 };

48 }

49})();

51const __dirname = dirname(fileURLToPath(import.meta.url));

53// Read the npm package version once so the MCP server, get_org, and the

54// `drafted://info` resource all report the same number — and it stays in

55// sync with package.json automatically (no hardcoded duplicate).

56const PACKAGE_VERSION = (() => {

Lines 2249-2289javascript

2249 action: 'update_mcp',

2250 started: false,

2251 updateSupported: false,

2252 mode,

2253 currentVersion: updateMetadata?.currentVersion || PACKAGE_VERSION,

2254 latestVersion: updateMetadata?.latestVersion || null,

2255 updateAvailable

cli/drafted.mjsView file

Lines 144-184javascript

144function readConfigServer() {

145 try {

146 if (existsSync(DEFAULT_CONFIG_FILE)) {

147 const cfg = JSON.parse(readFileSync(DEFAULT_CONFIG_FILE, 'utf8'));

148

install-mcp.shView file

•path = install-mcp.sh kind = build_helper sizeBytes = 53879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-mcp.shView on unpkg

Source & flagged code

5 flagged · loading source

mcp/server.mjsView file

10import { StdioServerTransport } from '@[redacted].js'; L11: import { execFile } from 'child_process'; L12: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

mcp/server.mjsView on unpkg · L10

2269const manualCommand = platform() === 'win32' L2270: ? `$tmp = Join-Path $env:TEMP "drafted-install.ps1"; Invoke-WebRequest -UseBasicParsing "${server}/install.ps1" -OutFile $tmp; powershell -NoProfile -ExecutionPolicy Bypass -File $... L2271: : `tmp=$(mktemp); curl -fsSL ${server}/install.sh -o "$tmp" && bash "$tmp"`;

High

Shell

Package source references shell execution.

mcp/server.mjsView on unpkg · L2269

36try { L37: return await import('../server/lib/umami.mjs'); L38: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp/server.mjsView on unpkg · L36

cli/drafted.mjsView file

164function getServerUrl() { L165: if (process.env.DRAFTED_SERVER) { L166: return process.env.DRAFTED_SERVER.replace(/\/$/, ''); ... L171: if (fromConfig) return String(fromConfig).replace(/\/$/, ''); L172: return `http://localhost:${process.env.DRAFTED_PORT || DEFAULT_PORT}`; L173: } ... L177: if (platform() === 'win32') { L178: const script = `$tmp = Join-Path $env:TEMP "drafted-install.ps1"; Invoke-WebRequest -UseBasicParsing "${server}/install.ps1" -OutFile $tmp; powershell -NoProfile -ExecutionPolicy B... L179: return {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/drafted.mjsView on unpkg · L164

install-mcp.shView file

•path = install-mcp.sh kind = build_helper sizeBytes = 53879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-mcp.shView on unpkg

Findings

3 High5 Medium5 Low

HighChild Processmcp/server.mjs

HighShellmcp/server.mjs

HighSame File Env Network Executioncli/drafted.mjs

MediumDynamic Requiremcp/server.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-mcp.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

mcp/server.mjsView file

Lines 1-56javascript

1#!/usr/bin/env node

3/**

4 * Drafted MCP Server

5 * Filesystem-style tools for agents to read/write/edit frames on the canvas.

6 * Calls the Drafted HTTP API directly (no CLI subprocess).

7 */

9import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';

10import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

11import { execFile } from 'child_process';

12import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

mcp/server.mjsView on unpkg · L10

13import { readFileSync, existsSync, realpathSync, writeFileSync, mkdirSync, unlinkSync, appendFileSync, readdirSync, statSync } from 'fs';

14import { join, dirname, basename, extname, resolve } from 'path';

15import { homedir, platform, release as osRelease, arch as osArch } from 'os';

16import { fileURLToPath } from 'url';

17import { AsyncLocalStorage } from 'node:async_hooks';

18import { z } from 'zod';

19import { registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';

20import WebSocket from 'ws';

21import { LAYERS } from '../src/shared/constants.mjs';

22import { emptyExcalidrawScene, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';

23import { formatOkfLogEntry, appendOkfLogEntry } from '../src/shared/okf-log.mjs';

24import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';

25import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';

27// Frame actions that mutate content — gated by G1 (wiki search before editing).

28// Read-style actions (read, search, versions, get_*/read_*) are exempt.

29const G1_MUTATING_FRAME_ACTIONS = new Set([

30 'write', 'write_excalidraw', 'edit', 'mv', 'anchor', 'restore_version',

31 'write_sheet_values', 'append_sheet_rows', 'clear_sheet_range', 'update_sheet',

32 'write_doc_content', 'append_doc_content', 'clear_doc_content', 'update_doc',

33 'write_slide_content', 'append_slides', 'clear_slides', 'update_slide',

34]);

35const { UMAMI_EVENTS, trackUmamiEvent } = await (async () => {

36 try {

37 return await import('../server/lib/umami.mjs');

38 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp/server.mjsView on unpkg · L36

39 return {

40 UMAMI_EVENTS: Object.freeze({

41 MCP_CONNECTED: 'mcp_connected',

42 MCP_TOOL_CALLED: 'mcp_tool_called',

43 DRAFTED_MCP_REQUEST: 'drafted_mcp_request',

44 DRAFTED_MCP_ERROR: 'drafted_mcp_error',

45 }),

46 trackUmamiEvent: () => {},

47 };

48 }

49})();

51const __dirname = dirname(fileURLToPath(import.meta.url));

53// Read the npm package version once so the MCP server, get_org, and the

54// `drafted://info` resource all report the same number — and it stays in

55// sync with package.json automatically (no hardcoded duplicate).

56const PACKAGE_VERSION = (() => {

Lines 2249-2289javascript

2249 action: 'update_mcp',

2250 started: false,

2251 updateSupported: false,

2252 mode,

2253 currentVersion: updateMetadata?.currentVersion || PACKAGE_VERSION,

2254 latestVersion: updateMetadata?.latestVersion || null,

2255 updateAvailable

cli/drafted.mjsView file

Lines 144-184javascript

144function readConfigServer() {

145 try {

146 if (existsSync(DEFAULT_CONFIG_FILE)) {

147 const cfg = JSON.parse(readFileSync(DEFAULT_CONFIG_FILE, 'utf8'));

148

install-mcp.shView file

•path = install-mcp.sh kind = build_helper sizeBytes = 53879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-mcp.shView on unpkg