registry / getlib-mcp / 1.4.1

getlib-mcp@1.4.1

GetLib MCP - powerful modular self-hostable library docs MCP server and dashboard (Context7 alternative)

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 211 file(s), 1.25 MB of source, external domains: 10play.github.io, actix.rs, ai-sdk.dev, ai.google.dev, ai.pydantic.dev, airflow.apache.org, alamofire.github.io, alembic.sqlalchemy.org, alpinejs.dev, angular.dev, animejs.com, ant.design, api.duckduckgo.com, api.github.com, appandflow.github.io, appwrite.io, aquasecurity.github.io, argo-cd.readthedocs.io, ariakit.org, arktype.io, authjs.dev, auto-animate.formkit.com, axiom.co, axios-http.com, bandit.readthedocs.io, baresearch.org, bcd.developer.mozilla.org, bevyengine.org, biomejs.dev, black.readthedocs.io, bun.sh, caddyserver.com, caniuse.com, capacitorjs.com, cheatsheetseries.owasp.org, cheerio.js.org, clerk.com, clickhouse.com, cloud.google.com, cmdk.paco.me, cobra.dev, code.claude.com, codemirror.net, conform.guide, console.groq.com, content-security-policy.com, content.nuxt.com, contentlayer.dev, crates.io, css-tricks.com

Source & flagged code

3 flagged

dist/server/mcp/sources/audit-patterns.jsView file

Lines 1-25javascript

1// Build security-pattern identifiers at runtime so static scanners

2// don't flag this audit tool itself as a vulnerability

3export const S = {

4 /** dangerouslySetInnerHTML */

5 dsiH: ["dangerous", "ly", "SetInner", "HTML"].join(""),

6 /** eval( */

7 dynExec: ["ev", "al", "("].join(""),

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server/mcp/sources/audit-patterns.jsView on unpkg · L5

8 /** eval */

9 dynExecFn: ["ev", "al"].join(""),

10 /** exec */

11 cmdRun: ["ex", "ec"].join(""),

12 /** spawn */

13 cmdFork: ["sp", "awn"].join(""),

14};

15export const DYNAMIC_CODE_RE = new RegExp(`\\b${S.dynExecFn}\\s*\\(`);

16export const DSIN_RE = new RegExp(S.dsiH);

17export const CMD_INJECT_RE = new RegExp(`\\b(?:${S.cmdRun}|${S.cmdRun}Sync|${S.cmdFork}|${S.cmdFork}Sync)\\s*\\([^)]*\\

18export const AUDIT_PATTERNS = [

19 // === LAYOUT / CLS ===

20 {

21 category: "layout",

22 severity: "high",

23 title: "Image missing width/height - causes CLS",

24 detail: "Images without explicit width and height cause Cumulative Layout Shift (CLS) - a Core Web Vital that affects search ranking.",

25 fix: "Add explicit width and height props, or use fill with a sized wrapper. In Next.js always use next/image.",

dist/server/mcp/services/client-identity.jsView file

Lines 1-35javascript

1import { createHash } from "crypto";

2/**

3 * Stable client identities for the control plane.

4 *

5 * Transports used to key sightings by raw user-agent strings, which break

6 * dashboard routes (slashes) and churn on every client update. Every

7 * sighting now resolves through identifyClient to one stable

8 * `<slug>=<uuid>` id: the slug is human-readable display metadata, the

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

getlib-mcp@1.4.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code