registry / mcp-efficiency-engine / 0.1.28

mcp-efficiency-engine@0.1.28

⚠ Under review

Local-first engineering harness platform for GitHub Copilot projects

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 783 KB of source, external domains: 127.0.0.1, nodejs.org

Source & flagged code

5 flagged

packages/mcp-server/src/server.jsView file

Lines 1-26javascript

1"use strict";

3const crypto = require("node:crypto");

4const fs = require("node:fs");

5const http = require("node:http");

6const path = require("node:path");

7const { spawn } = require("node:child_process");

8const { recordEvent, redact } = require("../../core/src/telemetry");

High

Child Process

Package source references child process execution.

packages/mcp-server/src/server.jsView on unpkg · L6

9const { McpServer } = require("@modelcontextprotocol/sdk/server/mcp.js");

10const { StdioServerTransport } = require("@modelcontextprotocol/sdk/server/stdio.js");

11const { z } = require("zod");

13const MAX_APPROVAL_BYTES = 64 * 1024;

14const MAX_PROCESS_OUTPUT_BYTES = 4 * 1024 * 1024;

16function approvalMessage(kind, details) {

17 if (kind === "project-data-transfer") {

18 return [

19 "Send the task and selected local project evidence to GitHub Copilot?",

20 `Workflow: ${details.workflow}; agent: ${details.agent}.`,

21 `Memory entries: ${details.memory_count}; knowledge sources: ${details.knowledge_source_count}; CodeGraph matches: ${details.codegraph_match_count}.`,

22 `Context: ${details.context_kind}; retrieval: ${details.context_retrieval || "routing summary"}; approximately ${details.estimated_tokens ?? "unknown"} tokens.`,

23 `Selected sources:\n${(details.selected_sources || []).map((source) => `- ${source}`).join("\n") || "- None"}`,

24 ].join("\n\n");

25 }

26 if (kind === "copilot-tool") {

packages/documentation-engine/src/generate.jsView file

Lines 1-22javascript

1"use strict";

3const fs = require("node:fs");

4const path = require("node:path");

packages/tool-manager/src/tools.jsView file

Lines 1-23javascript

1"use strict";

3const fs = require("node:fs");

4const https = require("node:https");

5const

packages/source-engine/src/embeddings_bge.pyView file

•path = packages/source-engine/src/embeddings_bge.py kind = build_helper sizeBytes = 18315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/source-engine/src/embeddings_bge.pyView on unpkg

packages/execution-engine/src/copilot.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/execution-engine/src/copilot.js#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged · loading source

packages/mcp-server/src/server.jsView file

6const path = require("node:path"); L7: const { spawn } = require("node:child_process"); L8: const { recordEvent, redact } = require("../../core/src/telemetry");

High

Child Process

Package source references child process execution.

packages/mcp-server/src/server.jsView on unpkg · L6

packages/documentation-engine/src/generate.jsView file

2L3: const fs = require("node:fs"); L4: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/documentation-engine/src/generate.jsView on unpkg · L2

packages/tool-manager/src/tools.jsView file

Findings

4 High5 Medium4 Low

HighChild Processpackages/mcp-server/src/server.js

HighShell

HighSame File Env Network Executionpackages/tool-manager/src/tools.js

HighSemantic Analysis Limitedpackages/execution-engine/src/copilot.js#virtual:normalized:round1

MediumDynamic Requirepackages/documentation-engine/src/generate.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpackages/source-engine/src/embeddings_bge.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mcp-efficiency-engine@0.1.28.

See all versions of mcp-efficiency-engine for other recorded verdicts.

Review the evidence and your use of mcp-efficiency-engine@0.1.28 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 18:08:07.286Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.