registry / nimble-js-mcp / 0.19.0

nimble-js-mcp@0.19.0

The official MCP Server for the Nimble API

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.35 MB of source, external domains: api.stainless.com, bun.sh, cursor.com, deno.land, docs.deno.com, docs.pydantic.dev, docs.python.org, endoflife.date, example.com, exapmle.com, github.com, go.dev, img.shields.io, jsr.io, my.test.proxy.example.com, my.test.server.example.com, npmjs.org, pkg.go.dev, pypi.org, raw.githubusercontent.com, sdk.nimbleway.com, semver.org, vscode.stainless.com, www.github.com, www.npmjs.com, www.python-httpx.org, www.stainless.com

Source & flagged code

3 flagged

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.getInstructions = getInstructions;

8const promises_1 = __importDefault(require("fs/promises"));

9const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

10const util_1 = require("./util.js");

11const INSTRUCTIONS_CACHE_TTL_MS = 15 * 60 * 1000; // 15 minutes

12const instructionsCache = new Map();

13async function getInstructions({ stainlessApiKey, customInstructionsPath, }) {

14 const now = Date.now();

15 const cacheKey = customInstructionsPath ?? stainlessApiKey ?? '';

16 const cached = instructionsCache.get(cacheKey);

17 if (cached && now - cached.fetchedAt <= INSTRUCTIONS_CACHE_TTL_MS) {

18 return cached.fetchedInstructions;

19 }

20 // Evict stale entries so the cache doesn't grow unboundedly.

21 for (const [key, entry] of instructionsCache) {

22 if (now - entry.fetchedAt > INSTRUCTIONS_CACHE_TTL_MS) {

23 instructionsCache.delete(key);

24 }

25 }

26 let fetchedInstructions;

27 if (customInstructionsPath) {

package.jsonView file

Lines 207-235json

207 "import": "./types.mjs",

208 "require": "./types.js"

209 },

210 "./types.js": {

211 "default": "./types.js"

212 },

213 "./types.mjs"

Source & flagged code

3 flagged · loading source

nimble-js-mcp@0.19.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code