registry / fa-mcp-sdk / 0.12.96

fa-mcp-sdk@0.12.96

⚠ Under review

Core infrastructure and templates for building Model Context Protocol (MCP) servers with TypeScript

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 142 file(s), 927 KB of source, external domains: example.com, github.com, json-schema.org, www.freedesktop.org, www.w3.org

Source & flagged code

13 flagged

dist/core/bootstrap/init-config.jsView file

Lines 62-89javascript

62 else if (urlRe.test(trim(homepage))) {

63 cfg.repo = urlRe.exec(homepage)?.[0] || '';

64 }

65 const pst = cfg.webServer?.auth?.permanentServerTokens;

66 if (typeof pst === 'string' && pst.includes(',')) {

67 cfg.webServer.auth.permanentServerTokens = pst.split(',').map(trim);

68 }

69 if (cfg.ad?.domains?.MYDOMAIN) {

70 delete cfg.ad.domains.MYDOMAIN;

71 }

72 return cfg;

73}

74export const appConfig = buildConfig();

75/**

76 * Returns configuration with sensitive data masked for safe display

77 */

78export function getSafeAppConfig() {

79 const cfg = JSON.parse(JSON.stringify(appConfig)); // Deep clone

80 // Mask database password

81 if (cfg.db?.postgres?.dbs?.main?.password) {

82 cfg.db.postgres.dbs.main.password = '[MASKED]';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/bootstrap/init-config.jsView on unpkg · L82

83 }

84 return cfg;

85}

86export function getProjectData() {

87 return global.__MCP_PROJECT_DATA__;

88}

89//# sourceMappingURL=init-config.js.map

dist/core/web/server-http.jsView file

Lines 669-709javascript

669 logger.info(`MCP SSE resumability enabled (in-memory, max ${appConfig.mcp.sse?.maxStoredEvents ?? 1000} events)`);

670 }

671 const evictOldestSession = (

scripts/kill-port.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2/**

3 * Kill process on specified port (cross-platform)

4 * Usage: node scripts/kill-port.js [port_number]

5 */

7import { exec } from 'child_process';

8import { promisify } from 'util';

cli-template/deploy/srv.cjsView file

Lines 1-40javascript

1#!/usr/bin/env node

3/**

4 * srv.cjs - Unified systemd service management script (Node.js version)

5 * Analog of deploy/srv.sh

6 * Can be run from project root or from deploy/ directory

7 */

8const version = '2025-11-26-08:46';

cli-template/deploy/pm2.config.jsView file

Lines 1-21javascript

1require('dotenv').config({ path: './.env', debug: true });

2const { name, main } = require('../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli-template/deploy/pm2.config.jsView on unpkg · L1

dist/core/agent-tester/services/TesterMcpClientService.jsView file

Lines 304-344javascript

304 return headers;

305 }

306 }

307 }

308 }

309 finally {

310 try {

311 await

bin/fa-mcp.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3import fss from 'fs';

4import fs from 'fs/promises';

5import path from 'path';

6import readline from

cli-template/update.cjsView file

6const path = require('path'); L7: const https = require('https'); L8: const YAML = require('yaml'); L9: const { execSync, spawn } = require('child_process'); L10: const os = require('os'); ... L15: // Name of this folder L16: const scriptDirName = require('path').basename(__dirname); L17: // Changing the working directory to a script directory ... L65: ly: (text) => console.log(color.ly(text)), L66: lg_no_newline: (msg) => process.stdout.write(color.lg(msg)), L67: }; ... L145: // Write back only the last 10KB

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli-template/update.cjsView on unpkg · L6

scripts/cc-hook-oxlint-oxfmt-fix.cjsView file

73try { L74: const output = execSync(`npx oxlint --fix "${filePath}"`, { L75: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/cc-hook-oxlint-oxfmt-fix.cjsView on unpkg · L73

cli-template/deploy/pm2reg.shView file

•path = cli-template/deploy/pm2reg.sh kind = build_helper sizeBytes = 1382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli-template/deploy/pm2reg.shView on unpkg

config/local-test.yamlView file

17patternName = generic_password severity = medium line = 17 matchedText = password...ass'

Medium

Secret Pattern

Hardcoded password in config/local-test.yaml

config/local-test.yamlView on unpkg · L17

Source & flagged code

13 flagged · loading source

dist/core/bootstrap/init-config.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code