registry / openrp-toolkit / 1.2.1

openrp-toolkit@1.2.1

⚠ Under review

Model Context Protocol (MCP) Server and AI Agent Skill Suite for OpenRP.ai

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 169 KB of source, external domains: 127.0.0.1, github.com, image.pollinations.ai, openrp.ai, registry.npmjs.org, uixnaquqjhzcctyfoapf.supabase.co

Source & flagged code

11 flagged

package.jsonView file

Lines 1-36json

2 "name": "openrp-toolkit",

3 "version": "1.2.1",

4 "description": "Model Context Protocol (MCP) Server and AI Agent Skill Suite for OpenRP.ai",

5 "main": "mcp/server.js",

6 "bin": {

7 "openrp-toolkit": "bin/cli.js",

8 "openrp": "bin/cli.js"

9 },

10 "scripts": {

11 "start": "node ./bin/cli.js",

12 "serve": "node ./bin/cli.js serve",

13 "sync": "node ./bin/cli.js sync",

14 "update": "node ./bin/cli.js update",

15 "release": "node ./bin/release.js",

16 "postinstall": "node ./bin/cli.js sync --silent || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "install-skill": "node ./bin/cli.js install",

18 "doctor": "node ./bin/cli.js doctor",

19 "auth": "node ./bin/cli.js auth",

20 "validate": "node ./bin/validator.js"

21 },

22 "files": [

23 "bin/",

24 "mcp/",

25 "skills/",

26 "examples/",

27 "README.md",

28 "LICENSE"

29 ],

30 "keywords": [

31 "openrp",

32 "mcp",

33 "model-context-protocol",

34 "ai-agent",

35 "gemini-cli",

36 "antigravity",

bin/release.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

3/**

4 * OpenRP Toolkit: Local 1-Click Release & Sync Engine

5 *

6 * Performs 100% local release without relying on GitHub Actions:

7 * 1. Pre-flight static validation of all behavior blueprints

8 * 2. Auto-sync skills & MCP configs to all local AI assistants (~/.agents, Claude, Codex, Cursor)

9 * 3. Version bump (patch / minor / major)

10 * 4. Direct npm publishing (npm publish --access public)

11 * 5. Git commit, tag, and push

bin/cli.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3/**

4 * OpenRP Toolkit CLI

5 * Model Context Protocol (MCP) Server & AI Agent Skill Installer

6 * Pure Node.js Edition - Zero External Dependencies

7 *

8 * Maintainer: Kaa (OpenRP Community Creator)

9 * Platform: https://openrp.ai

10 */

12const

bin/generate_image_behavior.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

3/**

4 * OpenRP Official Multimodal Image & RPG Story Generation Behavior

5 *

6 * 16-Node Full Visual Roleplay Pipeline:

7 * Ingestion -> Character RAG -> Dynamic Image Prompt Synthesizer -> LLM Roleplay Engine -> Image URL Generator -> Final Message Delivery

8 */

10const fs =

mcp/server.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * OpenRP Official MCP Server (Pure Node.js Edition)

5 * Zero external dependencies. Uses Node.js 18+ native fetch and stdio JSON-RPC 2.0.

6 * Maintainer: Kaa (OpenRP Community Creator)

7 * Platform: https://openrp.ai

8 */

10const fs = require

Source & flagged code

11 flagged · loading source

package.jsonView file

openrp-toolkit@1.2.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code