registry / klypix-mcp / 1.20.0

klypix-mcp@1.20.0

An open, local-first, agent-neutral canvas file your AI reads and writes over MCP — works with Claude, Cursor, Cline, any model.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 432 KB of source, external domains: klypix.com, registry.npmjs.org

Source & flagged code

3 flagged

src/klypix-core.mjsView file

Lines 1-28javascript

1// klypix-core — the protocol-neutral engine behind every KLYPIX agent face.

2//

3// All vault operations (list / read / search / create / append / insights /

4// connect / cross-project search) live here as pure-ish async functions that

5// return a protocol-neutral result:

6//

7// { blocks: Block[], isError?: boolean, file?: { name, buffer }, struct? }

8//

9// where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }.

10//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/klypix-core.mjsView on unpkg · L8

11// Two thin faces sit on top and never duplicate this logic:

12// - bin/klypix-mcp.mjs — maps blocks → MCP content blocks (the MCP server)

13// - bin/klypix-a2a.mjs — maps blocks → A2A Parts + returns `file` as a FilePart

14//

15// This file imports ONLY the pure format library (src/klypix-format.mjs) plus

16// Node built-ins, so it is safe to load from any process with no MCP/A2A/SDK in

17// the loop. It mutates nothing it isn't asked to (search/read never write).

19import fs from 'fs';

20import os from 'os';

21import path from 'path';

22import crypto from 'crypto';

23import { z } from 'zod';

24import {

25 parseKlypix, buildKlypix, buildKlypixMap, appendToKlypix, structToMarkdown,

26 brainInsights, insightsToMarkdown, addBrainConnections, proposeStructuralConnections, atomicWrite,

27 findUnrecordedMigrations, captureIntoBrain, tidyBrain, noteToCaptureInput,

28 selectGardenCandidates, applyGarden, detectContradictions,

Lines 138-178javascript

138 while (fs.existsSync(path.join(vault, `${name}.klypix`))) name = `${base} ${++n}`;

139 return `${name}.klypix`;

140}

141

142// ── On-device semantic memory (shared, lazy, self-healing) ───────────────────

143// Embeddings run INSIDE the long-lived host process, 100% local: transformers.js

144// (WASM) + a 23MB MiniLM model cached under ~/.claude/project-brain/hf-cache on

bin/klypix-mcp.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = klypix-mcp@1.19.0 matchedIdentity = npm:a2x5cGl4LW1jcA:1.19.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/klypix-mcp.mjsView on unpkg

Source & flagged code

3 flagged · loading source

src/klypix-core.mjsView file

158let t; L159: try { t = await import('@huggingface/transformers'); } L160: catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/klypix-core.mjsView on unpkg · L158

8// L9: // where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }. L10: // ... L53: export function resolveVault(explicit) { L54: return path.resolve(explicit || process.env.KLYPIX_VAULT || path.join(os.homedir(), 'Documents')); L55: } ... L264: const ext = p.split('.').pop().toLowerCase(); L265: blocks.push({ kind: 'image', data: b64, mime: IMG_MIME[ext] || 'image/png', name: p }); L266: included++;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/klypix-core.mjsView on unpkg · L8

bin/klypix-mcp.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/klypix-mcp.mjsView on unpkg

Findings

1 High3 Medium5 Low

HighPrevious Version Dangerous Deltabin/klypix-mcp.mjs

MediumDynamic Requiresrc/klypix-core.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptosrc/klypix-core.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/klypix-core.mjsView file

Lines 1-28javascript

1// klypix-core — the protocol-neutral engine behind every KLYPIX agent face.

2//

3// All vault operations (list / read / search / create / append / insights /

4// connect / cross-project search) live here as pure-ish async functions that

5// return a protocol-neutral result:

6//

7// { blocks: Block[], isError?: boolean, file?: { name, buffer }, struct? }

8//

9// where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }.

10//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/klypix-core.mjsView on unpkg · L8

11// Two thin faces sit on top and never duplicate this logic:

12// - bin/klypix-mcp.mjs — maps blocks → MCP content blocks (the MCP server)

13// - bin/klypix-a2a.mjs — maps blocks → A2A Parts + returns `file` as a FilePart

14//

15// This file imports ONLY the pure format library (src/klypix-format.mjs) plus

16// Node built-ins, so it is safe to load from any process with no MCP/A2A/SDK in

17// the loop. It mutates nothing it isn't asked to (search/read never write).

19import fs from 'fs';

20import os from 'os';

21import path from 'path';

22import crypto from 'crypto';

23import { z } from 'zod';

24import {

25 parseKlypix, buildKlypix, buildKlypixMap, appendToKlypix, structToMarkdown,

26 brainInsights, insightsToMarkdown, addBrainConnections, proposeStructuralConnections, atomicWrite,

27 findUnrecordedMigrations, captureIntoBrain, tidyBrain, noteToCaptureInput,

28 selectGardenCandidates, applyGarden, detectContradictions,

Lines 138-178javascript

138 while (fs.existsSync(path.join(vault, `${name}.klypix`))) name = `${base} ${++n}`;

139 return `${name}.klypix`;

140}

141

142// ── On-device semantic memory (shared, lazy, self-healing) ───────────────────

143// Embeddings run INSIDE the long-lived host process, 100% local: transformers.js

144// (WASM) + a 23MB MiniLM model cached under ~/.claude/project-brain/hf-cache on

bin/klypix-mcp.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/klypix-mcp.mjsView on unpkg