registry / openrp-toolkit / 1.0.0

openrp-toolkit@1.0.0

Model Context Protocol (MCP) Server and AI Agent Skill Suite for OpenRP.ai

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 77.3 KB of source, external domains: github.com, openrp.ai, uixnaquqjhzcctyfoapf.supabase.co

Source & flagged code

2 flagged

bin/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * OpenRP Toolkit CLI

5 * Model Context Protocol (MCP) Server & AI Agent Skill Installer

6 * Pure Node.js Edition - Zero External Dependencies

7 *

8 * Maintainer: Kaa (OpenRP Community Creator)

9 * Platform: https://openrp.ai

10 */

12const fs = require('fs');

13const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L11

14const os = require('os');

15const { execSync } = require('child_process');

16const readline = require('readline');

17const https = require('https');

19const PACKAGE_ROOT = path.resolve(__dirname, '..');

20const MCP_SERVER_SCRIPT = path.join(PACKAGE_ROOT, 'mcp', 'server.js');

21const SKILLS_DIR = path.join(PACKAGE_ROOT, 'skills', 'openrp');

22const AUTH_FILE = path.join(os.homedir(), '.openrp_mcp_auth.json');

24const args = process.argv.slice(2);

25const command = args[0] || 'serve';

27function printBanner() {

28 console.log('┌ OpenRP Toolkit & MCP Suite (v1.0.0)');

29 console.log('│ Maintainer: Kaa (https://github.com/kaaelix)');

30 console.log('│ Platform: https://openrp.ai');

31 console.log('└───────────────────────────────────────────────────────────────\n');

mcp/openrp_mcp_server.pyView file

•path = mcp/openrp_mcp_server.py kind = build_helper sizeBytes = 65826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mcp/openrp_mcp_server.pyView on unpkg

Source & flagged code

2 flagged · loading source

bin/cli.jsView file

11L12: const fs = require('fs'); L13: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L11

mcp/openrp_mcp_server.pyView file

•path = mcp/openrp_mcp_server.py kind = build_helper sizeBytes = 65826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mcp/openrp_mcp_server.pyView on unpkg

Findings

5 Medium4 Low

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpermcp/openrp_mcp_server.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to openrp-toolkit@1.0.0.

See version security history for other recorded verdicts.

Review the evidence and your use of openrp-toolkit@1.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 03:05:10.270Z (UTC).