registry  /  polygraph-currency-markers-mcp  /  0.0.1

polygraph-currency-markers-mcp@0.0.1

MCP server for currency marker utilities

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
EnvironmentVarsFilesystem
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.30 KB of source

Source & flagged code

1 flagged · loading source
lib/inspect.mjsView file
3import path from "node:path"; L4: import net from "node:net"; L5: ... L53: function fileStatus(raw) { L54: const p = raw.startsWith("~") ? path.join(os.homedir(), raw.slice(1)) : raw; L55: try { ... L70: for (const key of ENV_WATCH) { L71: const v = process.env[key]; L72: if (v === undefined || v === "") out[key] = { present: false }; ... L109: node: process.version, L110: platform: process.platform, L111: arch: process.arch,
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/inspect.mjsView on unpkg · L3

Findings

1 High1 Medium1 Low
HighCloud Metadata Accesslib/inspect.mjs
MediumEnvironment Vars
LowFilesystem