registry / saldo-mcp / 0.1.5

saldo-mcp@0.1.5

Saldo local connector — read-only MCP bridge between Nordic bank accounts and AI assistants.

Static Scan Results

scanned 40s ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 80.8 KB of source, external domains: 127.0.0.1, api.enablebanking.com, nodejs.org, saldo-broker.up.railway.app

Source & flagged code

3 flagged

.env.exampleView file

Lines 3-34text

3# need any EB_* values here — the broker holds the Enable Banking key and mints

4# tokens. Leave it unset for self-host mode (bring your own EB app, below).

5# SALDO_BROKER_URL=https://localhost:9443

7# Where the connector stores link/device state (which accounts are connected).

8# No transaction data is ever written here. Defaults to ~/.saldo

9# SALDO_DATA_DIR=/Users/you/.saldo

11# --- Enable Banking (https://enablebanking.com) ---

12# 1. Create a free account and register an Application in the control panel.

13# 2. Note the Application ID and download its RSA private key (.pem).

14# 3. Register the redirect URL below in the application settings (it must match).

15# On the free "Restricted Production" tier you can link your OWN accounts without

16# a contract; serving other users requires a signed contract + KYB.

18EB_APPLICATION_ID=

19# Inline PEM (the same variable the broker/Railway use). In a .env file put it on

20# one line with \n escapes (un-escaped at load); a real multi-line PEM also works.

21# Convert your .pem to the escaped one-liner with:

22# awk 'NF {printf "%s\\n", $0}' your_key.pem

23EB_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L23

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L23

25# Loopback URL the bank redirects to after authentication. Must exactly match the

26# redirect URL registered in the Enable Banking application. Enable Banking

27# requires https, so the connector serves this with a self-signed localhost cert

28# (your browser shows a one-time "not trusted" warning — click through).

29EB_REDIRECT_URL=https://localhost:8888/callback

31# --- Tink (future) ---

32# TINK_CLIENT_ID=

33# TINK_CLIENT_SECRET=

dist/providers/enablebanking/mappers.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { toMinorUnits } from "../../util/money.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/enablebanking/mappers.jsView on unpkg · L1

3/**

4 * Enable Banking identifies a bank by (name, country), not a single opaque id.

5 * We encode both into our Institution.id as "COUNTRY:Name" so createLink can

6 * reconstruct the aspsp. (Bank names may contain spaces — quote them on the CLI.)

Source & flagged code

3 flagged · loading source

.env.exampleView file

23patternName = private_key_rsa severity = critical line = 23 matchedText = EB_PRIVA...-\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L23

23patternName = private_key_rsa severity = critical line = 23 matchedText = EB_PRIVA...-\n"

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L23

dist/providers/enablebanking/mappers.jsView file

1import { createHash } from "node:crypto"; L2: import { toMinorUnits } from "../../util/money.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/enablebanking/mappers.jsView on unpkg · L1

Findings

2 Critical2 Medium6 Low

CriticalCritical Secret.env.example

CriticalSecret Pattern.env.example

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/providers/enablebanking/mappers.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

.env.exampleView file

Lines 3-34text

3# need any EB_* values here — the broker holds the Enable Banking key and mints

4# tokens. Leave it unset for self-host mode (bring your own EB app, below).

5# SALDO_BROKER_URL=https://localhost:9443

7# Where the connector stores link/device state (which accounts are connected).

8# No transaction data is ever written here. Defaults to ~/.saldo

9# SALDO_DATA_DIR=/Users/you/.saldo

11# --- Enable Banking (https://enablebanking.com) ---

12# 1. Create a free account and register an Application in the control panel.

13# 2. Note the Application ID and download its RSA private key (.pem).

14# 3. Register the redirect URL below in the application settings (it must match).

15# On the free "Restricted Production" tier you can link your OWN accounts without

16# a contract; serving other users requires a signed contract + KYB.

18EB_APPLICATION_ID=

19# Inline PEM (the same variable the broker/Railway use). In a .env file put it on

20# one line with \n escapes (un-escaped at load); a real multi-line PEM also works.

21# Convert your .pem to the escaped one-liner with:

22# awk 'NF {printf "%s\\n", $0}' your_key.pem

23EB_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L23

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L23

25# Loopback URL the bank redirects to after authentication. Must exactly match the

26# redirect URL registered in the Enable Banking application. Enable Banking

27# requires https, so the connector serves this with a self-signed localhost cert

28# (your browser shows a one-time "not trusted" warning — click through).

29EB_REDIRECT_URL=https://localhost:8888/callback

31# --- Tink (future) ---

32# TINK_CLIENT_ID=

33# TINK_CLIENT_SECRET=

dist/providers/enablebanking/mappers.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { toMinorUnits } from "../../util/money.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/enablebanking/mappers.jsView on unpkg · L1

3/**

4 * Enable Banking identifies a bank by (name, country), not a single opaque id.

5 * We encode both into our Institution.id as "COUNTRY:Name" so createLink can

6 * reconstruct the aspsp. (Bank names may contain spaces — quote them on the CLI.)