registry / fractascan-mcp / 0.1.20

fractascan-mcp@0.1.20

Model Context Protocol server exposing Fracta scan tools (passive_scan, scan_repo, …)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 9 file(s), 702 KB of source, external domains: api.anthropic.com, app.seu-dominio.com, cve.mitre.org, cwe.mitre.org, datatracker.ietf.org, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, docs.nestjs.com, docs.stripe.com, evil.com, exemplo.com.br, fracta.pro, github.com, json.schemastore.org, meuapp.com.br, owasp.org, platform.claude.com, semgrep.dev, supabase.com, www.gov.br, www.prisma.io, zap-api.tech

Source & flagged code

4 flagged

dist/index.jsView file

Lines 35-75javascript

35}

36function analyzeCsp(policy) {

37 const d = parse(policy);

38 const issues = [];

39 const scriptSrc = d.get("script-src") ?? d.get("default-src");

40 const styleSrc = d.get("style-src") ?? d.get("default-src");

41 const has = (dir) => d.has(dir);

42 if (scriptSrc?.includes("'unsafe-inline'") && !scriptSrc.some((v) => v.startsWith("'nonce-") || v.startsWith("'sha"))) {

43 issues.push({

44 rule: "csp-unsafe-inline-script",

45 severity: "high",

46 title: "CSP com 'unsafe-inline' em script-src",

47 detail: "'unsafe-inline' autoriza QUALQUER script inline \u2014 inclusive o injetado por XSS. Isso anula a principal prote\xE7\xE3o do CSP: o header existe, mas contra XSS n\xE3o vale quase nada.",

48 recommendation: "Remova 'unsafe-inline' de script-src e use nonce por request ou hash dos scripts inline (com 'strict-dynamic')."

49 });

50 }

51 if (scriptSrc?.includes("'unsafe-eval'")) {

52 issues.push({

53 rule: "csp-unsafe-eval",

54 severity: "medium",

55 title: "CSP com 'unsafe-eval' em script-src",

56 detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.",

57 recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L55

58 });

59 }

60 if (!has("script-src") && !has("default-src")) {

61 issues.push({

62 rule: "csp-no-script-src",

63 severity: "medium",

64 title: "CSP sem script-src nem default-src",

65 detail: "Sem script-src (nem default-src como fallback), a origem dos scripts n\xE3o \xE9 restringida pela policy.",

66 recommendation: "Defina script-src 'self' (+ nonce/hash p/ inline) ou ao menos um default-src 'self'."

67 });

68 }

69 if (scriptSrc && (scriptSrc.includes("*") || scriptSrc.includes("https:") || scriptSrc.includes("http:"))) {

70 issues.push({

71 rule: "csp-broad-script-src",

72 severity: "medium",

73 title: "CSP com script-src muito amplo (* / https:)",

74 detail: "Permitir '*', 'https:' ou 'http:' em script-src deixa carregar script de quase qualquer origem \u2014 enfraquece muito a prote\xE7\xE3o.",

75 recommendation: "Liste apenas as origens confi\xE1veis; prefira nonce/hash + strict-dynamic a curingas."

Lines 1214-1254javascript

1214 }

1215 }

1216 async testRateLimit(scope, findings) {

1217 const authEndpoint = scope.target.auth?.endpoint;

1218 if (!authEndpoint) {

1219 findings.push({

1220 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

1221 runId: scope.runId,

Lines 2091-2131javascript

2091 endpoint: path,

2092 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

2093 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu

Lines 4256-4296javascript

4256 category: this.category,

4257 camada: this.category,

4258 severity: "critical",

4259 title: `Prisma Studio exposto: ${path}`,

4260 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

Source & flagged code

4 flagged · loading source

dist/index.jsView file

1234patternName = generic_password severity = medium line = 1234 matchedText = const bo..." };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1234

2111patternName = generic_password severity = medium line = 2111 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L2111

4276patternName = generic_password severity = medium line = 4276 matchedText = password...99",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4276

55title: "CSP com 'unsafe-eval' em script-src", L56: detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.", L57: recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L55

Findings

6 Medium6 Low

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret Patterndist/index.js

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 35-75javascript

35}

36function analyzeCsp(policy) {

37 const d = parse(policy);

38 const issues = [];

39 const scriptSrc = d.get("script-src") ?? d.get("default-src");

40 const styleSrc = d.get("style-src") ?? d.get("default-src");

41 const has = (dir) => d.has(dir);

42 if (scriptSrc?.includes("'unsafe-inline'") && !scriptSrc.some((v) => v.startsWith("'nonce-") || v.startsWith("'sha"))) {

43 issues.push({

44 rule: "csp-unsafe-inline-script",

45 severity: "high",

46 title: "CSP com 'unsafe-inline' em script-src",

48 recommendation: "Remova 'unsafe-inline' de script-src e use nonce por request ou hash dos scripts inline (com 'strict-dynamic')."

49 });

50 }

51 if (scriptSrc?.includes("'unsafe-eval'")) {

52 issues.push({

53 rule: "csp-unsafe-eval",

54 severity: "medium",

55 title: "CSP com 'unsafe-eval' em script-src",

56 detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.",

57 recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L55

58 });

59 }

60 if (!has("script-src") && !has("default-src")) {

61 issues.push({

62 rule: "csp-no-script-src",

63 severity: "medium",

64 title: "CSP sem script-src nem default-src",

65 detail: "Sem script-src (nem default-src como fallback), a origem dos scripts n\xE3o \xE9 restringida pela policy.",

66 recommendation: "Defina script-src 'self' (+ nonce/hash p/ inline) ou ao menos um default-src 'self'."

67 });

68 }

69 if (scriptSrc && (scriptSrc.includes("*") || scriptSrc.includes("https:") || scriptSrc.includes("http:"))) {

70 issues.push({

71 rule: "csp-broad-script-src",

72 severity: "medium",

73 title: "CSP com script-src muito amplo (* / https:)",

74 detail: "Permitir '*', 'https:' ou 'http:' em script-src deixa carregar script de quase qualquer origem \u2014 enfraquece muito a prote\xE7\xE3o.",

75 recommendation: "Liste apenas as origens confi\xE1veis; prefira nonce/hash + strict-dynamic a curingas."

Lines 1214-1254javascript

1214 }

1215 }

1216 async testRateLimit(scope, findings) {

1217 const authEndpoint = scope.target.auth?.endpoint;

1218 if (!authEndpoint) {

1219 findings.push({

1220 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

1221 runId: scope.runId,

Lines 2091-2131javascript

2091 endpoint: path,

2092 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

2093 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu

Lines 4256-4296javascript

4256 category: this.category,

4257 camada: this.category,

4258 severity: "critical",

4259 title: `Prisma Studio exposto: ${path}`,

4260 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,