registry / leadmaps / 0.1.0

leadmaps@0.1.0

Connect AI agents (Claude, Cursor, Windsurf, n8n) to the Leadmaps European local-business database in one command.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 20.6 KB of source, external domains: api.leadmaps.io, app.leadmaps.io, leadmaps.io, mcp.leadmaps.io

Source & flagged code

1 flagged

cli.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// leadmaps — connect AI agents to the Leadmaps European business database.

3// Zero runtime dependencies. Node >= 18 (native fetch).

5import { readFileSync } from 'node:fs';

6import os from 'node:os';

7import { spawnSync } from 'node:child_process';

8import readline from 'node:readline/promises';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L6

9import {

10 AGENTS,

11 API_BASE,

12 CliError,

13 FIRST_PROMPT,

14 MCP_HEALTHZ,

15 MCP_URL,

16 SERVER_NAME,

17 buildServerEntry,

18 claudeMcpAddArgs,

19 configPathFor,

20 fetchUsage,

21 formatCount,

22 n8nRecipe,

23 parseArgs,

24 validateKeyLive,

25 validateKeyShape,

26 writeAgentConfig,

Source & flagged code

1 flagged · loading source

cli.mjsView file

6import os from 'node:os'; L7: import { spawnSync } from 'node:child_process'; L8: import readline from 'node:readline/promises'; ... L29: // Overridable for self-hosted / staging setups (documented in the README). L30: const apiBase = process.env.LEADMAPS_API_URL || API_BASE; L31: const mcpUrl = process.env.LEADMAPS_MCP_URL || MCP_URL; ... L35: L36: const useColor = Boolean(process.stdout.isTTY) && !('NO_COLOR' in process.env); L37: const paint = (code) => (s) => (useColor ? `\u001b[${code}m${s}\u001b[0m` : s); ... L59: L60: Keys are created at https://app.leadmaps.io/keys — a free lm_test_ sandbox L61: key works (no card). Docs: https://leadmaps.io/agents

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code