registry / jambavan / 1.0.0

jambavan@1.0.0

Local-first MCP memory and code intelligence that helps coding agents recall repo context, decisions, failures, and review impact.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a local MCP developer tool with explicitly enabled write and shell capabilities, rather than install-time or covert execution.

Static reason

One or more suspicious static signals were detected.

Trigger

User starts the CLI/MCP server and explicitly enables optional capabilities or invokes explicit mutation commands.

Impact

An authorized MCP host can write project files or run commands only after the operator enables the relevant environment flag; no covert persistence, credential exfiltration, or remote execution chain was found.

Mechanism

Opt-in project-scoped MCP file and shell tooling.

Rationale

The scanner findings correspond to intended local developer-tool functionality and are gated behind explicit runtime opt-ins or user-invoked CLI commands. Source inspection found no install-time execution, hidden network exfiltration, remote payload loading, or unconsented AI-agent configuration mutation.

Evidence

package.jsonsrc/mcp/server.tssrc/tools/bash.tssrc/tools/write-file.tssrc/tools/path-guard.tssrc/tools/gui.tssrc/index.ts.jambavan.github/pull_request_template.md

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

`src/tools/bash.ts` can execute user-supplied shell commands when enabled.
`src/tools/write-file.ts` can modify project files when enabled.
`src/index.ts` has explicit commands to write a PR template or post with `gh`.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
`src/mcp/server.ts` registers write and shell tools only with explicit `JAMBAVAN_ALLOW_WRITE=1` or `JAMBAVAN_ALLOW_BASH=1`.
`src/tools/path-guard.ts` confines file tools to the project and blocks common secret files by default.
`src/tools/bash.ts` uses a minimal environment by default and documents shell execution as opt-in.
`src/tools/gui.ts` binds its HTTP server only to `127.0.0.1`.
No outbound network client API or remote payload execution was found in `src`.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 88 file(s), 847 KB of source, external domains: 127.0.0.1, github.com

Source & flagged code

4 flagged

dist/tools/bash.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.shellInvocation = shellInvocation;

37exports.createBashTool = createBashTool;

38const child_process_1 = require("child_process");

39const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/tools/bash.jsView on unpkg · L37

40const util_1 = require("util");

41const path_guard_1 = require("./path-guard");

42const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);

43const PWD_MARKER = '__JAMBAVAN_PWD__';

44function shellInvocation(command, platform = process.platform) {

45 if (platform === 'win32') {

46 return {

47 file: 'powershell.exe',

48 args: [

49 '-NoLogo',

50 '-NoProfile',

51 '-NonInteractive',

52 '-Command',

53 `$ErrorActionPreference='Stop'; $env:NO_COLOR='1'; $env:FORCE_COLOR='0'; ${command}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; Write-Output "${PWD_MARKER}$((Get-Location).Path)"`,

54 ],

55 };

56 }

57 return {

src/tools/bash.tsView file

Lines 1-33typescript

1import { execFile } from 'child_process';

2import * as path from 'path';

3import { promisify } from 'util';

4import type { JambavanConfig } from '../config/jambavan.config';

5import type

dist/evaluation.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

src/tool-check.tsView file

Lines 1-32typescript

1#!/usr/bin/env node

2/**

3 * MCP tool check — drives the real Jambavan server over stdio (via the MCP SDK

4 * client) and calls every advertised tool with valid arguments, timing each.

5 *

6 * Runs against a throwaway fixture project (JAMBAVAN_ROOT=tempdir) so writes,

7 * bash, and memory deletes are harmless. Exits non-zero if any call fails.

8 */

10import * as fs from 'fs';

Source & flagged code

4 flagged · loading source

dist/tools/bash.jsView file

37exports.createBashTool = createBashTool; L38: const child_process_1 = require("child_process"); L39: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/tools/bash.jsView on unpkg · L37

src/tools/bash.tsView file

13return { L14: file: 'powershell.exe', L15: args: [

High

Shell

Package source references shell execution.

src/tools/bash.tsView on unpkg · L13

dist/evaluation.jsView file

40exports.runEvaluationCommand = runEvaluationCommand; L41: const fs = __importStar(require("fs")); L42: const TASK_FIELDS = [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/evaluation.jsView on unpkg · L40

src/tool-check.tsView file

12Cross-file remote execution chain: src/tool-check.ts spawns dist/index.js; helper contains network access plus dynamic code execution. L12: import * as path from 'path'; L13: import { execFileSync } from 'child_process'; L14: import { performance } from 'perf_hooks'; ... L35: async function main(): Promise<void> { L36: const repoRoot = process.cwd(); L37: const proj = fs.mkdtempSync(path.join(os.tmpdir(), 'jambavan-toolcheck-')); ... L53: const env: Record<string, string> = {}; L54: for (const [k, v] of Object.entries(process.env)) if (v != null) env[k] = v; L55: delete env.JAMBAVAN_ROOT; ... L118: L119: const stored = await call('jambavan_memory_store', { title: 'Test fact', body: 'The sky is blue.', scope: 'toolcheck' }); L120: const id = stored.match(/ID:\s*(\S+)/)?.[1] ?? 'toolcheck/test-fact';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/tool-check.tsView on unpkg · L12

Findings

3 High3 Medium4 Low

HighChild Processdist/tools/bash.js

HighShellsrc/tools/bash.ts

HighCross File Remote Execution Contextsrc/tool-check.ts

MediumDynamic Requiredist/evaluation.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

95%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Authorbeingmartinbmc

Maintainersbeingmartinbmc

Version1.0.0

PublishedJul 15, 2026

LicenseMIT

Dependencies13

Integrityverified

Package size720 KB

Files237

Keywordsmcpmodel-context-protocolcode-indextree-sitterdeveloper-toolsmcp-serverllm-memorycoding-agents

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → ./dist/index.d.tsbin → jambavan

Runtimenode >=20.19.0 <27

Artifact1.67 MB · 237 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: bench, build, clean, coverage +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

4 flagged

dist/tools/bash.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.shellInvocation = shellInvocation;

37exports.createBashTool = createBashTool;

38const child_process_1 = require("child_process");

39const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/tools/bash.jsView on unpkg · L37

40const util_1 = require("util");

41const path_guard_1 = require("./path-guard");

42const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);

43const PWD_MARKER = '__JAMBAVAN_PWD__';

44function shellInvocation(command, platform = process.platform) {

45 if (platform === 'win32') {

46 return {

47 file: 'powershell.exe',

48 args: [

49 '-NoLogo',

50 '-NoProfile',

51 '-NonInteractive',

52 '-Command',

53 `$ErrorActionPreference='Stop'; $env:NO_COLOR='1'; $env:FORCE_COLOR='0'; ${command}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; Write-Output "${PWD_MARKER}$((Get-Location).Path)"`,

54 ],

55 };

56 }

57 return {

src/tools/bash.tsView file

Lines 1-33typescript

1import { execFile } from 'child_process';

2import * as path from 'path';

3import { promisify } from 'util';

4import type { JambavanConfig } from '../config/jambavan.config';

5import type

dist/evaluation.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

src/tool-check.tsView file

Lines 1-32typescript

1#!/usr/bin/env node

2/**

3 * MCP tool check — drives the real Jambavan server over stdio (via the MCP SDK

4 * client) and calls every advertised tool with valid arguments, timing each.

5 *

6 * Runs against a throwaway fixture project (JAMBAVAN_ROOT=tempdir) so writes,

7 * bash, and memory deletes are harmless. Exits non-zero if any call fails.

8 */

10import * as fs from 'fs';