registry  /  punchlist-mcp  /  0.2.0

punchlist-mcp@0.2.0

MCP companion server for Punchlist — discover a Punchlist iOS device on your LAN and pull voice-narrated screen sessions (screenshots + synchronized transcripts) straight into Claude or any MCP client.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 452 KB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

3 flagged · loading source
dist/punchlist-mcp.cjsView file
41`);if(e===-1)return null;let r=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),W1(r)}clear(){this._buffer=void 0}};function W1(t)... L42: `}var La=class{constructor(e=Up.default.stdin,r=Up.default.stdout){this._stdin=e,this._stdout=r,this._readBuffer=new Da,this._started=!1,this._ondata=n=>{this._readBuffer.append(n)... L43: ${e}
High
Child Process

Package source references child process execution.

dist/punchlist-mcp.cjsView on unpkg · L41
29} L30: `)}else{let h=m[v];y.write(`const ${h} = ${l(v)};`),y.write(` L31: if (${h}.issues.length) payload.issues = payload.issues.concat(${h}.issues.map(iss => ({ ... L35: L36: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let f of this.seen.entries()){let d=f[1];if(e===f[0]){i(f);continue}if(n.external){let p=n.ex... L37: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r ... L41: `);if(e===-1)return null;let r=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),W1(r)}clear(){this._buffer=void 0}};function W1(t)... L42: `}var La=class{constructor(e=Up.default.stdin,r=Up.default.stdout){this._stdin=e,this._stdout=r,this._readBuffer=new Da,this._started=!1,this._ondata=n=>{this._readBuffer.append(n)... L43: ${e}
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/punchlist-mcp.cjsView on unpkg · L29
5|| (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,K._)`+${o}`);return;case"boolean":n.elseIf((0,K._)`${o} === "false" || ${o} === 0 || ${o} === null`).as... L6: || ${i} === "boolean" || ${o} === null`).assign(a,(0,K._)`[${o}]`)}}}function Zk({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,K._)`${e} !== undefined`,()=>t.assign((0,K._)`... L7: missingProperty: ${n},
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/punchlist-mcp.cjsView on unpkg · L5

Findings

2 High2 Medium7 Low
HighChild Processdist/punchlist-mcp.cjs
HighCommand Output Exfiltrationdist/punchlist-mcp.cjs
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/punchlist-mcp.cjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings