registry / executable-stories-mcp / 0.3.15

executable-stories-mcp@0.3.15

Read-only MCP server for executable-stories StoryReport JSON behavior catalogs.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 210 KB of source

Source & flagged code

1 flagged

dist/server.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3// src/server.ts

4import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

5import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

6import { z } from "zod";

8// src/index.ts

9import * as fs2 from "fs";

10import * as path3 from "path";

11import { spawn } from "child_process";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L10

13// ../executable-stories-core/dist/types/story-report.js

14var STORY_REPORT_SCHEMA_VERSION = "1.0";

16// ../executable-stories-core/dist/converters/acl/status.js

17var STATUS_MAP = {

18 pass: "passed",

19 fail: "failed",

20 skip: "skipped",

21 pending: "pending",

22 todo: "pending",

23 // Map todo → pending

24 timeout: "failed",

25 // Map timeout → failed

26 interrupted: "failed",

27 // Map interrupted → failed

28 unknown: "skipped"

29 // Safest default

30};

Source & flagged code

1 flagged · loading source

dist/server.jsView file

10import * as path3 from "path"; L11: import { spawn } from "child_process"; L12: ... L144: mediaType: raw.mediaType, L145: body: raw.body, L146: contentEncoding: raw.encoding ?? "BASE64" L147: }; ... L160: const filePath = raw.path; L161: const absolutePath = path.isAbsolute(filePath) ? filePath : path.resolve(options.projectRoot ?? process.cwd(), filePath); L162: if (!fs.existsSync(absolutePath)) { ... L945: cwd: args.cwd, L946: env: process.env

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code