registry  /  foxpilot-mcp  /  1.0.12

foxpilot-mcp@1.0.12

FoxPilot MCP Server — drive Firefox from an MCP client (tabs, history, content + opt-in page automation)

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsObfuscatedUrlStrings
Manifest
GitDependency
scanned 2 file(s), 1.39 MB of source, external domains: gist.github.com, github.com, json-schema.org, mathiasbynens.be, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.w3.org

Source & flagged code

4 flagged · loading source
dist/server.jsView file
34056// browser-api.ts L34057: var import_child_process = require("child_process"); L34058: var path2 = __toESM(require("path"));
High
Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L34056
1226Cross-file remote execution chain: dist/server.js spawns dist/broker-main.js; helper contains network access plus dynamic code execution. L1226: // validation function arguments L1227: data: new codegen_1.Name("data"), L1228: // data passed to validation function ... L2253: id = normalizeId(id); L2254: return resolver.resolve(baseId, id); L2255: } ... L3113: for (i = 0; i < input.length; i++) { L3114: code = input[i].charCodeAt(0); L3115: if (code === 48) { ... L6881: }; L6882: if (!process.env.WS_NO_BUFFER_UTIL) { L6883: try {
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.jsView on unpkg · L1226
2942sourceCode = this.opts.code.process(sourceCode, sch); L2943: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2944: const validate = makeValidate(this, this.scope.get());
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L2942
1226// validation function arguments L1227: data: new codegen_1.Name("data"), L1228: // data passed to validation function ... L2253: id = normalizeId(id); L2254: return resolver.resolve(baseId, id); L2255: } ... L3113: for (i = 0; i < input.length; i++) { L3114: code = input[i].charCodeAt(0); L3115: if (code === 48) { ... L6881: }; L6882: if (!process.env.WS_NO_BUFFER_UTIL) { L6883: try {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L1226

Findings

2 High4 Medium8 Low
HighChild Processdist/server.js
HighCross File Remote Execution Contextdist/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/server.js
LowWeak Cryptodist/server.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings