registry / port-authority-agent-terminal-mcp / 0.3.15

port-authority-agent-terminal-mcp@0.3.15

⚠ Under review

Cross-platform (Windows + macOS) lane coordinator for AI coding agents (Claude, Codex, etc.) — keeps multiple local agents from colliding on dev-server ports, Chrome debug ports, and Chrome user profiles. Includes a CLI, an MCP server, and a native Tauri

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 429 KB of source, external domains: 127.0.0.1, docs.claude.com, rustup.rs

Source & flagged code

10 flagged

package.jsonView file

Lines 52-92json

52 "gui/src-tauri/tauri.conf.json",

53 "gui/src-tauri/capabilities",

54 "gui/src-tauri/icons",

55 "gui/src-tauri/src",

56 "scripts/postinstall.cjs",

57 "scripts/build-dashboard-tauri.cjs",

58 "README.md",

59 "LICENSE",

60 "CHANGELOG.md"

61 ],

62 "scripts": {

63 "build": "npm run build:icons && npm run build:dashboard && tsc -p tsconfig.json",

64 "build:server": "tsc -p tsconfig.json",

65 "build:icons": "node scripts/build-icons.mjs",

66 "build:dashboard": "node scripts/build-dashboard-tauri.cjs",

67 "build:dashboard:strict": "node scripts/build-dashboard-tauri.cjs --strict",

68 "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",

69 "dev": "tsx src/cli/index.ts",

70 "prepare": "node scripts/prepare.cjs",

71 "prepack": "node scripts/prepack.cjs",

72 "postinstall": "node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e&&e.code==='MODULE_NOT_FOUND'&&String(e.message).includes('scripts/postinstall.cjs')){console.warn('[paat postinstall] skipped missing helper: '+e.message);process.exit(0)}throw e}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L72

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L72

73 "test": "tsc -p tsconfig.json && node --test --test-reporter=spec dist/tests/*.test.js",

74 "lint": "tsc -p tsconfig.json --noEmit",

75 "chrome": "tsx scripts/chrome.ts",

76 "robust-test": "tsx scripts/robust-test.ts",

77 "robust-test:verbose": "tsx scripts/robust-test.ts --verbose",

78 "prepublishOnly": "npm run clean && npm run build"

79 },

80 "keywords": [

81 "windows",

82 "ai-agents",

83 "agent-coordination",

84 "claude",

85 "claude-desktop",

86 "codex",

87 "codex-desktop",

88 "chrome",

89 "chrome-devtools-protocol",

90 "cdp",

91 "remote-debugging",

92 "playwright",

dist/src/core/pagejs.jsView file

Lines 1-38javascript

1/**

2 * In-page JavaScript snippets shared by BOTH page-control drivers (BiDi for

3 * Firefox, CDP for Chrome/Edge). Every snippet is a single EXPRESSION that

4 * evaluates to a JSON string, so both protocols get back `{type:"string"}`

5 * and the driver just JSON.parses it — identical semantics in every browser.

6 *

7 * All user-supplied fragments (selectors, values, expressions) are embedded

8 * via JSON.stringify so quotes/backslashes/newlines can never break out of

9 * the generated code.

10 */

scripts/build-dashboard-tauri.cjsView file

Lines 11-51javascript

11 * we don't want .msi/.dmg installers — npm is the install mechanism.

12 * 4. Copy the produced binary to bin/<binary-name> so the npm package can

13 * ship it. Naming:

bin/paat-dashboard.exeView file

•path = bin/paat-dashboard.exe kind = native_binary sizeBytes = 9714176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/paat-dashboard.exeView on unpkg

dist/src/cli/install-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.3.10 matchedPath = dist/src/cli/install-mcp.js matchedIdentity = npm:[redacted]:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High