registry / sdl-mcp / 0.12.1

sdl-mcp@0.12.1

Symbol Delta Ledger MCP Server - Cards-first code context for polyglot repositories

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 509 file(s), 5.67 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, github.com, huggingface.co, nodejs.org, opencode.ai

Source & flagged code

5 flagged

package.jsonView file

Lines 13-53json

13 },

14 "bugs": {

15 "url": "https://github.com/GlitterKill/sdl-mcp/issues"

16 },

17 "homepage": "https://github.com/GlitterKill/sdl-mcp#readme",

18 "files": [

19 "dist",

20 "config",

21 "templates/*.json",

22 "templates/*.md",

23 "templates/*.template",

24 "scripts/postinstall.mjs",

25 "scripts/postinstall-watchman.mjs",

26 "scripts/postinstall-tree-sitter.mjs",

27 "scripts/postinstall-prune.mjs",

28 "scripts/postinstall-models.mjs",

29 "README.md",

30 "LICENSE"

31 ],

32 "scripts": {

33 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "clean:dist": "node scripts/clean-dist.mjs",

35 "build": "tsc -p tsconfig.build.json && node scripts/copy-ui-assets.mjs",

36 "build:scripts": "tsc -p tsconfig.scripts.json && node scripts/fix-imports.ts",

37 "build:runtime": "npm run clean:dist && npm run build",

38 "build:all": "npm run clean:dist && npm run build && npm run build:scripts",

39 "watch": "tsc -p tsconfig.build.json --watch",

40 "dev": "node src/main.ts",

41 "typecheck": "tsc --noEmit",

42 "lint": "eslint src",

43 "format": "prettier --write \"src/**/*.ts\"",

44 "test": "node scripts/run-tests.mjs",

45 "test:unit": "node scripts/run-tests.mjs --group=unit",

46 "test:integration": "node scripts/run-tests.mjs --group=integration",

47 "test:property": "node scripts/run-tests.mjs --group=property",

48 "test:native": "npm run build:all && npm run test:native-parity && npm run test:native-index-smoke && npm run test:parity",

49 "test:benchmark": "node scripts/run-tests.mjs --group=benchmark",

50 "test:root": "node scripts/run-tests.mjs --group=root",

51 "test:golden-files": "node scripts/run-tests.mjs --group=golden",

52 "test:harness": "npm run test:adapters",

53 "test:adapters": "npm run build && npx tsc --rootDir tests/harness --outDir dist/tests/harness --module nodenext tests/harness/adapter-runner.ts && node dist/tests/harness/adapter-runner.js",

dist/scip/decoder-rust.jsView file

Lines 1-30javascript

1/**

2 * Rust-native SCIP decoder that wraps the napi-rs ScipDecodeHandle.

3 *

4 * Mirrors the native addon loading pattern from src/indexer/rustIndexer.ts.

5 * Falls back gracefully when the native addon is unavailable.

6 */

7import { createRequire } from "module";

8import { join } from "path";

9import { fileURLToPath } from

dist/db/ladybug.jsView file

Lines 70-110javascript

70 markExtensionLoaded(ext);

71 }

72 else {

73 markExtensionUnavailable(ext);

74 }

75 }

76}

77const require = createRequire(import.meta.url);

dist/mcp/tools/runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sdl-mcp@0.11.13 matchedIdentity = npm:c2RsLW1jcA:0.11.13 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp/tools/runtime.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scip/decoder-rust.jsView file

10import { logger } from "../util/logger.js"; L11: const require = createRequire(import.meta.url); L12: const __dirname = fileURLToPath(new URL(".", import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scip/decoder-rust.jsView on unpkg · L10

dist/db/ladybug.jsView file

90/** @internal exported for focused config/env tests. */ L91: export function [redacted](env = process.env, explicitValue) { L92: const candidate = explicitValue ?? Number.parseInt((env[CHECKPOINT_THRESHOLD_ENV] ?? "").trim(), 10); ... L332: try { L333: await exec(conn, "RETURN 1"); L334: return true;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/db/ladybug.jsView on unpkg · L90

dist/mcp/tools/runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp/tools/runtime.jsView on unpkg

Findings

2 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltadist/mcp/tools/runtime.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/scip/decoder-rust.js

MediumUnsafe Vm Contextdist/db/ladybug.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 13-53json

13 },

14 "bugs": {

15 "url": "https://github.com/GlitterKill/sdl-mcp/issues"

16 },

17 "homepage": "https://github.com/GlitterKill/sdl-mcp#readme",

18 "files": [

19 "dist",

20 "config",

21 "templates/*.json",

22 "templates/*.md",

23 "templates/*.template",

24 "scripts/postinstall.mjs",

25 "scripts/postinstall-watchman.mjs",

26 "scripts/postinstall-tree-sitter.mjs",

27 "scripts/postinstall-prune.mjs",

28 "scripts/postinstall-models.mjs",

29 "README.md",

30 "LICENSE"

31 ],

32 "scripts": {

33 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "clean:dist": "node scripts/clean-dist.mjs",

35 "build": "tsc -p tsconfig.build.json && node scripts/copy-ui-assets.mjs",

36 "build:scripts": "tsc -p tsconfig.scripts.json && node scripts/fix-imports.ts",

37 "build:runtime": "npm run clean:dist && npm run build",

38 "build:all": "npm run clean:dist && npm run build && npm run build:scripts",

39 "watch": "tsc -p tsconfig.build.json --watch",

40 "dev": "node src/main.ts",

41 "typecheck": "tsc --noEmit",

42 "lint": "eslint src",

43 "format": "prettier --write \"src/**/*.ts\"",

44 "test": "node scripts/run-tests.mjs",

45 "test:unit": "node scripts/run-tests.mjs --group=unit",

46 "test:integration": "node scripts/run-tests.mjs --group=integration",

47 "test:property": "node scripts/run-tests.mjs --group=property",

48 "test:native": "npm run build:all && npm run test:native-parity && npm run test:native-index-smoke && npm run test:parity",

49 "test:benchmark": "node scripts/run-tests.mjs --group=benchmark",

50 "test:root": "node scripts/run-tests.mjs --group=root",

51 "test:golden-files": "node scripts/run-tests.mjs --group=golden",

52 "test:harness": "npm run test:adapters",

53 "test:adapters": "npm run build && npx tsc --rootDir tests/harness --outDir dist/tests/harness --module nodenext tests/harness/adapter-runner.ts && node dist/tests/harness/adapter-runner.js",

dist/scip/decoder-rust.jsView file

Lines 1-30javascript

1/**

2 * Rust-native SCIP decoder that wraps the napi-rs ScipDecodeHandle.

3 *

4 * Mirrors the native addon loading pattern from src/indexer/rustIndexer.ts.

5 * Falls back gracefully when the native addon is unavailable.

6 */

7import { createRequire } from "module";

8import { join } from "path";

9import { fileURLToPath } from

dist/db/ladybug.jsView file

Lines 70-110javascript

70 markExtensionLoaded(ext);

71 }

72 else {

73 markExtensionUnavailable(ext);

74 }

75 }

76}

77const require = createRequire(import.meta.url);

dist/mcp/tools/runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp/tools/runtime.jsView on unpkg