registry / erdmaker-mcp / 0.8.1

erdmaker-mcp@0.8.1

MCP server for erdmaker - query and edit ERDs with your team's naming standards

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 267 KB of source, external domains: bpnqagbpuxercrozzjrz.supabase.co, erdmaker-site.vercel.app, github.com

Source & flagged code

2 flagged

dist/chunk-CGMM4NCP.jsView file

Lines 29-69javascript

29 throw error;

30 }

31}

32async function loadCredentials() {

33 try {

34 const raw = JSON.parse(await readFile(credentialsPath(), "utf8"));

35 return typeof raw?.refreshToken === "string" ? raw : null;

36 } catch {

37 return null;

38 }

39}

40async function deleteCredentials() {

41 await rm(credentialsPath(), { force: true });

42}

44// src/auth/supabaseNode.ts

45import { createClient } from "@supabase/supabase-js";

47// src/auth/defaults.ts

48var DEFAULT_SUPABASE_URL = "https://bpnqagbpuxercrozzjrz.supabase.co";

49var DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImJwbnFhZ2JwdXhlcmNyb3p6anJ6Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzY4MjUwNTcsImV4cCI6MjA5MjQwMTA1N30.M6c-cQM4GtFZXsGSH7lMw7KfVRAEM-FmlgbLbtZe3vA";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-CGMM4NCP.jsView on unpkg · L49

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-CGMM4NCP.js

dist/chunk-CGMM4NCP.jsView on unpkg · L49

51// src/auth/supabaseNode.ts

52function resolveSupabaseConfig() {

53 return {

54 url: process.env.ERDMAKER_SUPABASE_URL ?? DEFAULT_SUPABASE_URL,

55 anonKey: process.env.ERDMAKER_SUPABASE_ANON_KEY ?? DEFAULT_SUPABASE_ANON_KEY

56 };

57}

58function createNodeSupabaseClient() {

59 const { url, anonKey } = resolveSupabaseConfig();

60 if (!url || !anonKey) {

61 throw new ToolError(

62 "not_configured",

63 "Supabase \uC811\uC18D \uC815\uBCF4\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4. ERDMAKER_SUPABASE_URL/ERDMAKER_SUPABASE_ANON_KEY \uD658\uACBD\uBCC0\uC218\uB97C \uC124\uC815\uD558\uAC70\uB098 mcp/src/auth/defaults.ts\uC758 \uAE30\uBCF8\uAC12\uC744 \uCC44\uC6B0\uC138\uC694."

64 );

65 }

66 return createClient(url, anonKey, {

67 auth: { persistSession: false, autoRefreshToken: false }

68 });

69}

Source & flagged code

2 flagged · loading source

dist/chunk-CGMM4NCP.jsView file

49patternName = supabase_service_key severity = critical line = 49 matchedText = var DEFA...vA";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-CGMM4NCP.jsView on unpkg · L49

49patternName = supabase_service_key severity = critical line = 49 matchedText = var DEFA...vA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-CGMM4NCP.js

dist/chunk-CGMM4NCP.jsView on unpkg · L49

Findings

2 Critical1 Medium4 Low

CriticalCritical Secretdist/chunk-CGMM4NCP.js

CriticalSecret Patterndist/chunk-CGMM4NCP.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-CGMM4NCP.jsView file

Lines 29-69javascript

29 throw error;

30 }

31}

32async function loadCredentials() {

33 try {

34 const raw = JSON.parse(await readFile(credentialsPath(), "utf8"));

35 return typeof raw?.refreshToken === "string" ? raw : null;

36 } catch {

37 return null;

38 }

39}

40async function deleteCredentials() {

41 await rm(credentialsPath(), { force: true });

42}

44// src/auth/supabaseNode.ts

45import { createClient } from "@supabase/supabase-js";

47// src/auth/defaults.ts

48var DEFAULT_SUPABASE_URL = "https://bpnqagbpuxercrozzjrz.supabase.co";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-CGMM4NCP.jsView on unpkg · L49

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-CGMM4NCP.js

dist/chunk-CGMM4NCP.jsView on unpkg · L49

51// src/auth/supabaseNode.ts

52function resolveSupabaseConfig() {

53 return {

54 url: process.env.ERDMAKER_SUPABASE_URL ?? DEFAULT_SUPABASE_URL,

55 anonKey: process.env.ERDMAKER_SUPABASE_ANON_KEY ?? DEFAULT_SUPABASE_ANON_KEY

56 };

57}

58function createNodeSupabaseClient() {

59 const { url, anonKey } = resolveSupabaseConfig();

60 if (!url || !anonKey) {

61 throw new ToolError(

62 "not_configured",

64 );

65 }

66 return createClient(url, anonKey, {

67 auth: { persistSession: false, autoRefreshToken: false }

68 });

69}