registry / jambavan / 0.3.0

jambavan@0.3.0

Jambavan — an MCP server that awakens any coding model's latent powers: live code index, precise context, durable memory, a code knowledge graph, prompt compression, and guarded file/shell tools.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 196 KB of source

Source & flagged code

1 flagged

dist/tools/path-guard.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.resolveInsideRoot = resolveInsideRoot;

37exports.projectRelative = projectRelative;

38const fs = __importStar(require("fs"));

39const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/path-guard.jsView on unpkg · L37

40// Files that commonly hold credentials. Denied to ALL file tools (read + write)

41// unless JAMBAVAN_ALLOW_SECRETS=1. This is the one shared guard, not a per-tool patch.

42const SECRET_BASENAMES = new Set([

43 '.npmrc', '.netrc', '.pgpass', '.htpasswd',

44 'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519',

45]);

46const SECRET_PATTERNS = [

47 /^\.env(\..+)?$/i, // .env, .env.local, .env.production

48 /\.(pem|key|p12|pfx|keystore|jks)$/i,

49];

50function assertNotSecret(target, label) {

51 if (process.env.JAMBAVAN_ALLOW_SECRETS === '1')

52 return;

53 const base = path.basename(target);

54 if (SECRET_BASENAMES.has(base) || SECRET_PATTERNS.some(re => re.test(base))) {

55 throw new Error(`${label} blocked: "${base}" looks like a secret file (set JAMBAVAN_ALLOW_SECRETS=1 to override)`);

56 }

57}

Source & flagged code

1 flagged · loading source

dist/tools/path-guard.jsView file

37exports.projectRelative = projectRelative; L38: const fs = __importStar(require("fs")); L39: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/path-guard.jsView on unpkg · L37

Findings

2 Medium3 Low

MediumDynamic Requiredist/tools/path-guard.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/tools/path-guard.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.resolveInsideRoot = resolveInsideRoot;

37exports.projectRelative = projectRelative;

38const fs = __importStar(require("fs"));

39const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/path-guard.jsView on unpkg · L37

40// Files that commonly hold credentials. Denied to ALL file tools (read + write)

41// unless JAMBAVAN_ALLOW_SECRETS=1. This is the one shared guard, not a per-tool patch.

42const SECRET_BASENAMES = new Set([

43 '.npmrc', '.netrc', '.pgpass', '.htpasswd',

44 'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519',

45]);

46const SECRET_PATTERNS = [

47 /^\.env(\..+)?$/i, // .env, .env.local, .env.production

48 /\.(pem|key|p12|pfx|keystore|jks)$/i,

49];

50function assertNotSecret(target, label) {

51 if (process.env.JAMBAVAN_ALLOW_SECRETS === '1')

52 return;

53 const base = path.basename(target);

54 if (SECRET_BASENAMES.has(base) || SECRET_PATTERNS.some(re => re.test(base))) {

55 throw new Error(`${label} blocked: "${base}" looks like a secret file (set JAMBAVAN_ALLOW_SECRETS=1 to override)`);

56 }

57}