registry  /  punchlist-mcp  /  0.6.0

punchlist-mcp@0.6.0

MCP companion server for Punchlist — discover a Punchlist iOS device on your LAN and pull voice-narrated screen sessions (screenshots + synchronized transcripts) straight into Claude or any MCP client.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 476 KB of source, external domains: github.com, icloud.developer.apple.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

4 flagged · loading source
dist/punchlist-mcp.cjsView file
41`);if(e===-1)return null;let r=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),zO(r)}clear(){this._buffer=void 0}};function zO(t)... L42: `}var Xa=class{constructor(e=of.default.stdin,r=of.default.stdout){this._stdin=e,this._stdout=r,this._readBuffer=new Ja,this._started=!1,this._ondata=n=>{this._readBuffer.append(n)... L43: ${e}
High
Child Process

Package source references child process execution.

dist/punchlist-mcp.cjsView on unpkg · L41
35L36: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let f of this.seen.entries()){let d=f[1];if(e===f[0]){i(f);continue}if(n.external){let p=n.ex... L37: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r ... L41: `);if(e===-1)return null;let r=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),zO(r)}clear(){this._buffer=void 0}};function zO(t)... L42: `}var Xa=class{constructor(e=of.default.stdin,r=of.default.stdout){this._stdin=e,this._stdout=r,this._readBuffer=new Ja,this._started=!1,this._ondata=n=>{this._readBuffer.append(n)... L43: ${e}
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/punchlist-mcp.cjsView on unpkg · L35
29} L30: `)}else{let h=m[v];y.write(`const ${h} = ${l(v)};`),y.write(` L31: if (${h}.issues.length) payload.issues = payload.issues.concat(${h}.issues.map(iss => ({ ... L35: L36: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let f of this.seen.entries()){let d=f[1];if(e===f[0]){i(f);continue}if(n.external){let p=n.ex... L37: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r ... L41: `);if(e===-1)return null;let r=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),zO(r)}clear(){this._buffer=void 0}};function zO(t)... L42: `}var Xa=class{constructor(e=of.default.stdin,r=of.default.stdout){this._stdin=e,this._stdout=r,this._readBuffer=new Ja,this._started=!1,this._ondata=n=>{this._readBuffer.append(n)... L43: ${e}
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/punchlist-mcp.cjsView on unpkg · L29
5|| (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,G._)`+${o}`);return;case"boolean":n.elseIf((0,G._)`${o} === "false" || ${o} === 0 || ${o} === null`).as... L6: || ${i} === "boolean" || ${o} === null`).assign(a,(0,G._)`[${o}]`)}}}function _T({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G._)`... L7: missingProperty: ${n},
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/punchlist-mcp.cjsView on unpkg · L5

Findings

3 High3 Medium7 Low
HighChild Processdist/punchlist-mcp.cjs
HighSame File Env Network Executiondist/punchlist-mcp.cjs
HighCommand Output Exfiltrationdist/punchlist-mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/punchlist-mcp.cjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings