registry  /  scrivener-mcp  /  0.8.1

scrivener-mcp@0.8.1

MCP server for Scrivener - Read, write, analyze, and search manuscripts with semantic search, character/plot tracking, writing analysis, and content enhancement. Works with Claude, ChatGPT, and other AI assistants.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
CopyleftLicense
scanned 145 file(s), 1.55 MB of source, external domains: adoptium.net, api.anthropic.com, api.openai.com, brew.sh, docs.docker.com, docs.microsoft.com, download.keydb.dev, github.com, neo4j.com, ollama.ai

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/core/config-manager.jsView file
178if (includeSensitive) { L179: return JSON.parse(JSON.stringify(this.config)); L180: } ... L250: } L251: // Private methods L252: setupConfigPaths() { L253: const baseDir = process.cwd(); L254: this.configPaths = [ ... L378: for (const [envVar, configPath] of Object.entries(envMappings)) { L379: const value = process.env[envVar]; L380: if (value) {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/config-manager.jsView on unpkg · L178
dist/services/auto-setup/ai-config-wizard.jsView file
9import * as readline from 'readline'; L10: import { execFileSync } from 'child_process'; L11: import { getLogger } from '../../core/logger.js'; ... L15: constructor() { L16: this.configDir = join(homedir(), '.scrivener-mcp'); L17: this.configPath = join(this.configDir, 'ai-config.json'); ... L24: input: process.stdin, L25: output: process.stdout, L26: }); ... L34: const configData = await readFile(this.configPath, 'utf-8'); L35: return JSON.parse(configData); L36: }
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/services/auto-setup/ai-config-wizard.jsView on unpkg · L9

Findings

2 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/services/auto-setup/ai-config-wizard.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/core/config-manager.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License