registry / jambavan / 0.4.0

jambavan@0.4.0

Jambavan — an MCP server that awakens any coding model's latent powers: live code index, precise context, durable memory, a code knowledge graph, prompt compression, and guarded file/shell tools.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 246 KB of source

Source & flagged code

1 flagged

dist/tools/path-guard.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.resolveInsideRoot = resolveInsideRoot;

37exports.projectRelative = projectRelative;

38const fs = __importStar(require("fs"));

39const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/path-guard.jsView on unpkg · L37

40// Files that commonly hold credentials. Denied to ALL file tools (read + write)

41// unless JAMBAVAN_ALLOW_SECRETS=1. This is the one shared guard, not a per-tool patch.

42const SECRET_BASENAMES = new Set([

43 '.npmrc', '.netrc', '.pgpass', '.htpasswd',

44 'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519',

45 'credentials', // .aws/credentials

46 '.git-credentials', // git credential store

47]);

48const SECRET_PATTERNS = [

49 /^\.env(\..+)?$/i, // .env, .env.local, .env.production

50 /\.(pem|key|p12|pfx|keystore|jks)$/i,

51 /^service[-_]?account.*\.json$/i, // GCP service account key files

52];

53// Parent directories that make otherwise-innocent filenames secret

54const SECRET_PARENT_DIRS = new Set(['.aws', '.docker', '.ssh']);

55function assertNotSecret(target, label) {

56 if (process.env.JAMBAVAN_ALLOW_SECRETS === '1')

57 return;

Source & flagged code

1 flagged · loading source

dist/tools/path-guard.jsView file

37exports.projectRelative = projectRelative; L38: const fs = __importStar(require("fs")); L39: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/path-guard.jsView on unpkg · L37

Findings

2 Medium3 Low

MediumDynamic Requiredist/tools/path-guard.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/tools/path-guard.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.resolveInsideRoot = resolveInsideRoot;

37exports.projectRelative = projectRelative;

38const fs = __importStar(require("fs"));

39const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/path-guard.jsView on unpkg · L37

40// Files that commonly hold credentials. Denied to ALL file tools (read + write)

41// unless JAMBAVAN_ALLOW_SECRETS=1. This is the one shared guard, not a per-tool patch.

42const SECRET_BASENAMES = new Set([

43 '.npmrc', '.netrc', '.pgpass', '.htpasswd',

44 'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519',

45 'credentials', // .aws/credentials

46 '.git-credentials', // git credential store

47]);

48const SECRET_PATTERNS = [

49 /^\.env(\..+)?$/i, // .env, .env.local, .env.production

50 /\.(pem|key|p12|pfx|keystore|jks)$/i,

51 /^service[-_]?account.*\.json$/i, // GCP service account key files

52];

53// Parent directories that make otherwise-innocent filenames secret

54const SECRET_PARENT_DIRS = new Set(['.aws', '.docker', '.ssh']);

55function assertNotSecret(target, label) {

56 if (process.env.JAMBAVAN_ALLOW_SECRETS === '1')

57 return;