registry / kimetsu-remote / 2.5.2

kimetsu-remote@2.5.2

Kimetsu Remote (beta) — server-hosted Kimetsu brain over HTTP MCP. Installs the prebuilt native server binary for your platform. Separate from the `kimetsu-ai` CLI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.35 KB of source, external domains: github.com

Source & flagged code

2 flagged

bin/cli.jsView file

Lines 1-62javascript

1#!/usr/bin/env node

2"use strict";

4// Launcher for the `kimetsu-remote` npm package — the server-hosted Kimetsu

5// brain (HTTP MCP). It is a SEPARATE package from `kimetsu-ai` (the CLI); the

6// remote server is intentionally not bundled with the CLI.

7//

8// The native binary ships through per-platform optionalDependencies

9// (@kimetsu-ai/remote-<platform>-<arch>) built with `--features embeddings,tls`.

10// npm installs only the one matching the host; this launcher execs its binary,

11// forwarding all args, stdio, and the exit code.

13const { spawnSync } = require("child_process");

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L12

15// key = `${process.platform}-${process.arch}`. Only the targets with an ONNX

16// Runtime prebuilt get an embeddings+tls server binary (mirrors the embeddings

17// flavor in release.yml). Elsewhere: `cargo install kimetsu-remote`.

18const PLATFORMS = {

19 "linux-x64": { pkg: "@kimetsu-ai/remote-linux-x64", bin: "kimetsu-remote" },

20 "darwin-arm64": { pkg: "@kimetsu-ai/remote-darwin-arm64", bin: "kimetsu-remote" },

21 "win32-x64": { pkg: "@kimetsu-ai/remote-win32-x64", bin: "kimetsu-remote.exe" },

22};

24const REPO_URL = "https://github.com/RodCor/kimetsu";

26function fail(message) {

27 process.stderr.write(`kimetsu-remote: ${message}\n`);

28 process.exit(1);

29}

31const key = `${process.platform}-${process.arch}`;

32const entry = PLATFORMS[key];

33if (!entry) {

34 fail(

35 `no prebuilt kimetsu-remote binary for ${key} (${process.platform}/${process.arch}).\n` +

36 `Prebuilt npm binaries cover: ${Object.keys(PLATFORMS).join(", ")}.\n` +

37 `Install another way:\n` +

38 ` - cargo install kimetsu-remote --features embeddings\n` +

39 ` - grab a kimetsu-remote archive from ${REPO_URL}/releases`

40 );

41}

43let binPath;

44try {

45 binPath = require.resolve(`${entry.pkg}/bin/${entry.bin}`);

46} catch (_err) {

47 fail(

48 `the platform package ${entry.pkg} is not installed.\n` +

49 `npm may have skipped optional dependencies (e.g. --no-optional or\n` +

50 `--ignore-scripts). Reinstall with optional deps enabled:\n` +

51 ` npm install -g kimetsu-remote\n` +

52 `Or: cargo install kimetsu-remote --features embeddings, or an archive\n` +

53 `from ${REPO_URL}/releases`

54 );

55}

57const result = spawnSync(binPath, process.argv.slice(2), { stdio: "inherit" });

58if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L50

59 fail(`failed to launch the server binary: ${result.error.message}`);

60}

61process.exit(result.status === null ? 1 : result.status);

Source & flagged code

2 flagged · loading source

bin/cli.jsView file

12L13: const { spawnSync } = require("child_process"); L14:

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L12

50`--ignore-scripts). Reinstall with optional deps enabled:\n` + L51: ` npm install -g kimetsu-remote\n` + L52: `Or: cargo install kimetsu-remote --features embeddings, or an archive\n` + ... L56: L57: const result = spawnSync(binPath, process.argv.slice(2), { stdio: "inherit" }); L58: if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L50

Findings

2 High1 Low

HighChild Processbin/cli.js

HighRuntime Package Installbin/cli.js

LowUrl Strings

Source & flagged code

2 flagged

bin/cli.jsView file

Lines 1-62javascript

1#!/usr/bin/env node

2"use strict";

4// Launcher for the `kimetsu-remote` npm package — the server-hosted Kimetsu

5// brain (HTTP MCP). It is a SEPARATE package from `kimetsu-ai` (the CLI); the

6// remote server is intentionally not bundled with the CLI.

7//

8// The native binary ships through per-platform optionalDependencies

9// (@kimetsu-ai/remote-<platform>-<arch>) built with `--features embeddings,tls`.

10// npm installs only the one matching the host; this launcher execs its binary,

11// forwarding all args, stdio, and the exit code.

13const { spawnSync } = require("child_process");

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L12

15// key = `${process.platform}-${process.arch}`. Only the targets with an ONNX

16// Runtime prebuilt get an embeddings+tls server binary (mirrors the embeddings

17// flavor in release.yml). Elsewhere: `cargo install kimetsu-remote`.

18const PLATFORMS = {

19 "linux-x64": { pkg: "@kimetsu-ai/remote-linux-x64", bin: "kimetsu-remote" },

20 "darwin-arm64": { pkg: "@kimetsu-ai/remote-darwin-arm64", bin: "kimetsu-remote" },

21 "win32-x64": { pkg: "@kimetsu-ai/remote-win32-x64", bin: "kimetsu-remote.exe" },

22};

24const REPO_URL = "https://github.com/RodCor/kimetsu";

26function fail(message) {

27 process.stderr.write(`kimetsu-remote: ${message}\n`);

28 process.exit(1);

29}

31const key = `${process.platform}-${process.arch}`;

32const entry = PLATFORMS[key];

33if (!entry) {

34 fail(

35 `no prebuilt kimetsu-remote binary for ${key} (${process.platform}/${process.arch}).\n` +

36 `Prebuilt npm binaries cover: ${Object.keys(PLATFORMS).join(", ")}.\n` +

37 `Install another way:\n` +

38 ` - cargo install kimetsu-remote --features embeddings\n` +

39 ` - grab a kimetsu-remote archive from ${REPO_URL}/releases`

40 );

41}

43let binPath;

44try {

45 binPath = require.resolve(`${entry.pkg}/bin/${entry.bin}`);

46} catch (_err) {

47 fail(

48 `the platform package ${entry.pkg} is not installed.\n` +

49 `npm may have skipped optional dependencies (e.g. --no-optional or\n` +

50 `--ignore-scripts). Reinstall with optional deps enabled:\n` +

51 ` npm install -g kimetsu-remote\n` +

52 `Or: cargo install kimetsu-remote --features embeddings, or an archive\n` +

53 `from ${REPO_URL}/releases`

54 );

55}

57const result = spawnSync(binPath, process.argv.slice(2), { stdio: "inherit" });

58if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L50

59 fail(`failed to launch the server binary: ${result.error.message}`);

60}

61process.exit(result.status === null ? 1 : result.status);