registry / erdmaker-mcp / 0.2.0

erdmaker-mcp@0.2.0

MCP server for erdmaker - query and edit ERDs with your team's naming standards

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 191 KB of source, external domains: bpnqagbpuxercrozzjrz.supabase.co

Source & flagged code

2 flagged

dist/chunk-T7BKJOS7.jsView file

Lines 36-76javascript

36 throw error;

37 }

38}

39async function loadCredentials() {

40 try {

41 const raw = JSON.parse(await readFile(credentialsPath(), "utf8"));

42 return typeof raw?.refreshToken === "string" ? raw : null;

43 } catch {

44 return null;

45 }

46}

47async function deleteCredentials() {

48 await rm(credentialsPath(), { force: true });

49}

51// src/auth/supabaseNode.ts

52import { createClient } from "@supabase/supabase-js";

54// src/auth/defaults.ts

55var DEFAULT_SUPABASE_URL = "https://bpnqagbpuxercrozzjrz.supabase.co";

56var DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImJwbnFhZ2JwdXhlcmNyb3p6anJ6Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzY4MjUwNTcsImV4cCI6MjA5MjQwMTA1N30.M6c-cQM4GtFZXsGSH7lMw7KfVRAEM-FmlgbLbtZe3vA";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-T7BKJOS7.jsView on unpkg · L56

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-T7BKJOS7.js

dist/chunk-T7BKJOS7.jsView on unpkg · L56

58// src/auth/supabaseNode.ts

59function resolveSupabaseConfig() {

60 return {

61 url: process.env.ERDMAKER_SUPABASE_URL ?? DEFAULT_SUPABASE_URL,

62 anonKey: process.env.ERDMAKER_SUPABASE_ANON_KEY ?? DEFAULT_SUPABASE_ANON_KEY

63 };

64}

65function createNodeSupabaseClient() {

66 const { url, anonKey } = resolveSupabaseConfig();

67 if (!url || !anonKey) {

68 throw new ToolError(

69 "not_configured",

70 "Supabase \uC811\uC18D \uC815\uBCF4\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4. ERDMAKER_SUPABASE_URL/ERDMAKER_SUPABASE_ANON_KEY \uD658\uACBD\uBCC0\uC218\uB97C \uC124\uC815\uD558\uAC70\uB098 mcp/src/auth/defaults.ts\uC758 \uAE30\uBCF8\uAC12\uC744 \uCC44\uC6B0\uC138\uC694."

71 );

72 }

73 return createClient(url, anonKey, {

74 auth: { persistSession: false, autoRefreshToken: false }

75 });

76}

Source & flagged code

2 flagged · loading source

dist/chunk-T7BKJOS7.jsView file

56patternName = supabase_service_key severity = critical line = 56 matchedText = var DEFA...vA";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-T7BKJOS7.jsView on unpkg · L56

56patternName = supabase_service_key severity = critical line = 56 matchedText = var DEFA...vA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-T7BKJOS7.js

dist/chunk-T7BKJOS7.jsView on unpkg · L56

Findings

2 Critical1 Medium4 Low

CriticalCritical Secretdist/chunk-T7BKJOS7.js

CriticalSecret Patterndist/chunk-T7BKJOS7.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-T7BKJOS7.jsView file

Lines 36-76javascript

36 throw error;

37 }

38}

39async function loadCredentials() {

40 try {

41 const raw = JSON.parse(await readFile(credentialsPath(), "utf8"));

42 return typeof raw?.refreshToken === "string" ? raw : null;

43 } catch {

44 return null;

45 }

46}

47async function deleteCredentials() {

48 await rm(credentialsPath(), { force: true });

49}

51// src/auth/supabaseNode.ts

52import { createClient } from "@supabase/supabase-js";

54// src/auth/defaults.ts

55var DEFAULT_SUPABASE_URL = "https://bpnqagbpuxercrozzjrz.supabase.co";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-T7BKJOS7.jsView on unpkg · L56

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-T7BKJOS7.js

dist/chunk-T7BKJOS7.jsView on unpkg · L56

58// src/auth/supabaseNode.ts

59function resolveSupabaseConfig() {

60 return {

61 url: process.env.ERDMAKER_SUPABASE_URL ?? DEFAULT_SUPABASE_URL,

62 anonKey: process.env.ERDMAKER_SUPABASE_ANON_KEY ?? DEFAULT_SUPABASE_ANON_KEY

63 };

64}

65function createNodeSupabaseClient() {

66 const { url, anonKey } = resolveSupabaseConfig();

67 if (!url || !anonKey) {

68 throw new ToolError(

69 "not_configured",

71 );

72 }

73 return createClient(url, anonKey, {

74 auth: { persistSession: false, autoRefreshToken: false }

75 });

76}