registry  /  genexus-mcp  /  2.13.2

genexus-mcp@2.13.2

GeneXus 18 MCP server — read, edit, and analyze GeneXus knowledge base objects (transactions, web panels, procedures, SDTs) directly from Claude, Cursor, and other AI agents over the Model Context Protocol.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 215 KB of source, external domains: 127.0.0.1, api.github.com, github.com, opencode.ai, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

3 flagged · loading source
cli/lib/update-check.jsView file
3const path = require('path'); L4: const https = require('https'); L5: const { spawn } = require('child_process'); L6: const { ... L19: try { L20: const pkg = require('../../package.json'); L21: return typeof pkg.version === 'string' ? pkg.version : null; ... L30: // platforms fall back to ~/.genexus-mcp (the gateway is Windows-only). L31: if (process.platform === 'win32') { L32: const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'); L33: return path.join(base, 'GenexusMCP', 'update-check.json'); ... L45: const raw = fs.readFileSync(getCacheFile(), 'utf8');
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/lib/update-check.jsView on unpkg · L3
publish/System.Management.dllView file
•path = publish/System.Management.dll kind = native_binary sizeBytes = 835584 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

publish/System.Management.dllView on unpkg
publish/start_mcp.batView file
•path = publish/start_mcp.bat kind = build_helper sizeBytes = 723 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish/start_mcp.batView on unpkg

Findings

1 High5 Medium4 Low
HighSandbox Evasion Gated Capabilitycli/lib/update-check.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarypublish/System.Management.dll
MediumShips Build Helperpublish/start_mcp.bat
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings