registry / novada-mcp / 0.9.3

novada-mcp@0.9.3

One MCP server for all web data. Search, scrape, crawl, proxy, and AI research in one install.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 75 file(s), 965 KB of source, external domains: api-m.novada.com, api.novada.com, dashboard.novada.com, developer-api.novada.com, docs.example.com, example.com, github.com, scraper.novada.com, status.novada.com, web.archive.org, webunlocker.novada.com, www.novada.com

Source & flagged code

8 flagged

build/tools/proxy.jsView file

Lines 106-138javascript

106 ``,

107 `# Set NOVADA_PROXY_PASS in your environment first:`,

108 `curl --proxy "${proxyUrlShell}" <your-url>`,

109 ``,

110 `## Agent Hints`,

111 `- Add this flag to any curl command to route through the proxy.`,

112 `- For multi-step workflows needing the same IP, add session_id param.`,

113 ].join("\n");

114 }

115 // Default: url format

116 return [

117 `## Proxy Configuration`,

118 `type: ${typeLabel}`,

119 params.country ? `targeting: ${params.country.toUpperCase()}${params.city ? ` / ${params.city}` : ""}` : "",

120 params.session_id ? `session: ${params.session_id} (sticky IP)` : "session: rotating (new IP per request)",

121 `proxy_url: ${maskedUrl}`,

122 ``,

123 `## Usage Examples`,

124 ``,

125 `Node.js (axios):`,

126 ` proxy: { host: "${proxyHost}", port: ${proxyPort}, auth: { username: "<PROXY_USER>", password: "<NOVADA_PROXY_PASS>" } }`,

Medium

Secret Pattern

Package contains a possible secret pattern.

build/tools/proxy.jsView on unpkg · L126

127 ``,

128 `Python (requests):`,

129 ` proxies = { "http": "${maskedUrl}", "https": "${maskedUrl}" }`,

130 ` # Replace *** with the value of NOVADA_PROXY_PASS`,

131 ``,

132 `## Agent Hints`,

133 `- proxy_url above shows *** for the password — read NOVADA_PROXY_PASS from your environment to complete it.`,

134 `- For consistent IP across a workflow, set session_id (e.g. "my-session-1").`,

135 `- For web extraction tasks, novada_extract handles proxy routing automatically.`,

136 ].filter(l => l !== "").join("\n");

137}

138//# sourceMappingURL=proxy.js.map

skills/novada-agent/setup.shView file

•path = skills/novada-agent/setup.sh kind = build_helper sizeBytes = 493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/novada-agent/setup.shView on unpkg

build/tools/types.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = novada-mcp@0.9.15 matchedIdentity = npm:bm92YWRhLW1jcA:0.9.15 similarity = 0.781 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/tools/types.jsView on unpkg

build/tools/proxy_residential.jsView file

Lines 104-137javascript

104 ``,

105 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

106 `curl --proxy "${maskedUrl}" <your-url>`,

107 ``,

108 `## agent_instruction`,

109 `Best for geo-restricted content. Use country param for targeting. Residential IPs bypass most anti-bot systems.`,

110 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`

build/tools/proxy_account_create.jsView file

Lines 67-107javascript

67/**

68 * Create a proxy sub-account on api-m.novada.com (`/v1/proxy_account/create`).

69 *

70 * Two-step confirm gate: without `confirm: true`, the tool returns a preview

71 * payload and does NOT hit the API. Agents MUST surface the preview to the

72 * human user and only re-call with `confirm: true` after explicit approval.

73 *

74 * Request body is multipart/form-data per the API contract — handled centrally

75 * by devApiPost. Fields posted: product, account, password, status,

76 * remark?, limit_flow?.

77 */

build/tools/proxy_mobile.jsView file

Lines 107-141javascript

107 ``,

108 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

109 `curl --proxy "${maskedUrl}" <your-url>`,

110 ``,

111 `## agent_instruction`,

112 `Mobile IPs. Best for mobile-targeted content and apps. Pair with mobile User-Agent for best results.`,

113 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`

build/tools/proxy_datacenter.jsView file

Lines 95-128javascript

95 ``,

96 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

97 `curl --proxy "${maskedUrl}" <your-url>`,

98 ``,

99 `## agent_instruction`,

100 `Fastest proxies. Best for high-volume, non-anti-bot targets. If blocked, upgrade to novada_proxy_isp or novada_proxy_residential.`,

101 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`

build/tools/proxy_isp.jsView file

Lines 97-130javascript

97 ``,

98 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

99 `curl --proxy "${maskedUrl}" <your-url>`,

100 ``,

101 `## agent_instruction`,

102 `ISP proxies look like real home users. Best for social/ecommerce. Use novada_proxy_residential for stronger anti-bot scenarios.`,

103 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`

Source & flagged code

8 flagged · loading source

build/tools/proxy.jsView file

126patternName = generic_password severity = medium line = 126 matchedText = ` proxy... }`,

Medium

Secret Pattern

Package contains a possible secret pattern.

build/tools/proxy.jsView on unpkg · L126

skills/novada-agent/setup.shView file

•path = skills/novada-agent/setup.sh kind = build_helper sizeBytes = 493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/novada-agent/setup.shView on unpkg

build/tools/types.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/tools/types.jsView on unpkg

build/tools/proxy_residential.jsView file

124patternName = generic_password severity = medium line = 124 matchedText = ` proxy... }`,

Medium

Secret Pattern

Hardcoded password in build/tools/proxy_residential.js

build/tools/proxy_residential.jsView on unpkg · L124

build/tools/proxy_account_create.jsView file

87patternName = generic_password severity = medium line = 87 matchedText = password...**",

Medium

Secret Pattern

Hardcoded password in build/tools/proxy_account_create.js

build/tools/proxy_account_create.jsView on unpkg · L87

build/tools/proxy_mobile.jsView file

127patternName = generic_password severity = medium line = 127 matchedText = ` proxy... }`,

Medium

Secret Pattern

Hardcoded password in build/tools/proxy_mobile.js

build/tools/proxy_mobile.jsView on unpkg · L127

build/tools/proxy_datacenter.jsView file

115patternName = generic_password severity = medium line = 115 matchedText = ` proxy... }`,

Medium

Secret Pattern

Hardcoded password in build/tools/proxy_datacenter.js

build/tools/proxy_datacenter.jsView on unpkg · L115

build/tools/proxy_isp.jsView file

117patternName = generic_password severity = medium line = 117 matchedText = ` proxy... }`,

Medium

Secret Pattern

Hardcoded password in build/tools/proxy_isp.js

build/tools/proxy_isp.jsView on unpkg · L117

Findings

1 High10 Medium5 Low

HighPrevious Version Dangerous Deltabuild/tools/types.js

MediumSecret Patternbuild/tools/proxy.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/novada-agent/setup.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternbuild/tools/proxy_residential.js

MediumSecret Patternbuild/tools/proxy_account_create.js

MediumSecret Patternbuild/tools/proxy_mobile.js

MediumSecret Patternbuild/tools/proxy_datacenter.js

MediumSecret Patternbuild/tools/proxy_isp.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

build/tools/proxy.jsView file

Lines 106-138javascript

106 ``,

107 `# Set NOVADA_PROXY_PASS in your environment first:`,

108 `curl --proxy "${proxyUrlShell}" <your-url>`,

109 ``,

110 `## Agent Hints`,

111 `- Add this flag to any curl command to route through the proxy.`,

112 `- For multi-step workflows needing the same IP, add session_id param.`,

113 ].join("\n");

114 }

115 // Default: url format

116 return [

117 `## Proxy Configuration`,

118 `type: ${typeLabel}`,

119 params.country ? `targeting: ${params.country.toUpperCase()}${params.city ? ` / ${params.city}` : ""}` : "",

120 params.session_id ? `session: ${params.session_id} (sticky IP)` : "session: rotating (new IP per request)",

121 `proxy_url: ${maskedUrl}`,

122 ``,

123 `## Usage Examples`,

124 ``,

125 `Node.js (axios):`,

126 ` proxy: { host: "${proxyHost}", port: ${proxyPort}, auth: { username: "<PROXY_USER>", password: "<NOVADA_PROXY_PASS>" } }`,

Medium

Secret Pattern

Package contains a possible secret pattern.

build/tools/proxy.jsView on unpkg · L126

127 ``,

128 `Python (requests):`,

129 ` proxies = { "http": "${maskedUrl}", "https": "${maskedUrl}" }`,

130 ` # Replace *** with the value of NOVADA_PROXY_PASS`,

131 ``,

132 `## Agent Hints`,

133 `- proxy_url above shows *** for the password — read NOVADA_PROXY_PASS from your environment to complete it.`,

134 `- For consistent IP across a workflow, set session_id (e.g. "my-session-1").`,

135 `- For web extraction tasks, novada_extract handles proxy routing automatically.`,

136 ].filter(l => l !== "").join("\n");

137}

138//# sourceMappingURL=proxy.js.map

skills/novada-agent/setup.shView file

•path = skills/novada-agent/setup.sh kind = build_helper sizeBytes = 493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/novada-agent/setup.shView on unpkg

build/tools/types.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/tools/types.jsView on unpkg

build/tools/proxy_residential.jsView file

Lines 104-137javascript

104 ``,

105 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

106 `curl --proxy "${maskedUrl}" <your-url>`,

107 ``,

108 `## agent_instruction`,

109 `Best for geo-restricted content. Use country param for targeting. Residential IPs bypass most anti-bot systems.`,

110 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`

build/tools/proxy_account_create.jsView file

Lines 67-107javascript

67/**

68 * Create a proxy sub-account on api-m.novada.com (`/v1/proxy_account/create`).

69 *

70 * Two-step confirm gate: without `confirm: true`, the tool returns a preview

71 * payload and does NOT hit the API. Agents MUST surface the preview to the

72 * human user and only re-call with `confirm: true` after explicit approval.

73 *

74 * Request body is multipart/form-data per the API contract — handled centrally

75 * by devApiPost. Fields posted: product, account, password, status,

76 * remark?, limit_flow?.

77 */

build/tools/proxy_mobile.jsView file

Lines 107-141javascript

107 ``,

108 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

109 `curl --proxy "${maskedUrl}" <your-url>`,

110 ``,

111 `## agent_instruction`,

112 `Mobile IPs. Best for mobile-targeted content and apps. Pair with mobile User-Agent for best results.`,

113 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`

build/tools/proxy_datacenter.jsView file

Lines 95-128javascript

95 ``,

96 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

97 `curl --proxy "${maskedUrl}" <your-url>`,

98 ``,

99 `## agent_instruction`,

100 `Fastest proxies. Best for high-volume, non-anti-bot targets. If blocked, upgrade to novada_proxy_isp or novada_proxy_residential.`,

101 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`

build/tools/proxy_isp.jsView file

Lines 97-130javascript

97 ``,

98 `# Add this flag to any curl command — replace *** with $NOVADA_PROXY_PASS:`,

99 `curl --proxy "${maskedUrl}" <your-url>`,

100 ``,

101 `## agent_instruction`,

102 `ISP proxies look like real home users. Best for social/ecommerce. Use novada_proxy_residential for stronger anti-bot scenarios.`,

103 `To get the actual proxy URL with credentials: substitute *** with the runtime value of the NOVADA_PROXY_PASS environment variable.`