registry / sdl-mcp / 0.11.13

sdl-mcp@0.11.13

Symbol Delta Ledger MCP Server - Cards-first code context for polyglot repositories

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 506 file(s), 5.56 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, github.com, huggingface.co, nodejs.org, opencode.ai

Source & flagged code

4 flagged

package.jsonView file

Lines 13-53json

13 },

14 "bugs": {

15 "url": "https://github.com/GlitterKill/sdl-mcp/issues"

16 },

17 "homepage": "https://github.com/GlitterKill/sdl-mcp#readme",

18 "files": [

19 "dist",

20 "config",

21 "templates/*.json",

22 "templates/*.md",

23 "templates/*.template",

24 "scripts/postinstall.mjs",

25 "scripts/postinstall-watchman.mjs",

26 "scripts/postinstall-tree-sitter.mjs",

27 "scripts/postinstall-prune.mjs",

28 "scripts/postinstall-models.mjs",

29 "README.md",

30 "LICENSE"

31 ],

32 "scripts": {

33 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "clean:dist": "node scripts/clean-dist.mjs",

35 "build": "tsc -p tsconfig.build.json && node scripts/copy-ui-assets.mjs",

36 "build:scripts": "tsc -p tsconfig.scripts.json && node scripts/fix-imports.ts",

37 "build:runtime": "npm run clean:dist && npm run build",

38 "build:all": "npm run clean:dist && npm run build && npm run build:scripts",

39 "watch": "tsc -p tsconfig.build.json --watch",

40 "dev": "node src/main.ts",

41 "typecheck": "tsc --noEmit",

42 "lint": "eslint src",

43 "format": "prettier --write \"src/**/*.ts\"",

44 "test": "node scripts/run-tests.mjs",

45 "test:harness": "npm run test:adapters",

46 "test:adapters": "npm run build && npx tsc --rootDir tests/harness --outDir dist/tests/harness --module nodenext tests/harness/adapter-runner.ts && node dist/tests/harness/adapter-runner.js",

47 "test:golden": "npm run build && node scripts/golden/update-goldens.ts validate",

48 "golden:update": "npm run build && node scripts/golden/update-goldens.ts generate",

49 "benchmark:ci": "node dist/cli/index.js benchmark:ci",

50 "migrate": "npm run build:scripts && node dist/scripts/migrate.js",

51 "index": "npm run build:scripts && node dist/scripts/index-repo.js",

52 "index-repo": "npm run build:scripts && node dist/scripts/index-repo.js",

53 "dump-symbol": "npm run build:scripts && node dist/scripts/dump-symbol.js",

dist/scip/decoder-rust.jsView file

Lines 1-30javascript

1/**

2 * Rust-native SCIP decoder that wraps the napi-rs ScipDecodeHandle.

3 *

4 * Mirrors the native addon loading pattern from src/indexer/rustIndexer.ts.

5 * Falls back gracefully when the native addon is unavailable.

6 */

7import { createRequire } from "module";

8import { join } from "path";

9import { fileURLToPath } from

dist/db/ladybug.jsView file

Lines 70-110javascript

70 markExtensionLoaded(ext);

71 }

72 else {

73 markExtensionUnavailable(ext);

74 }

75 }

76}

77const require = createRequire(import.meta.url);

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scip/decoder-rust.jsView file

10import { logger } from "../util/logger.js"; L11: const require = createRequire(import.meta.url); L12: const __dirname = fileURLToPath(new URL(".", import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scip/decoder-rust.jsView on unpkg · L10

dist/db/ladybug.jsView file

90/** @internal exported for focused config/env tests. */ L91: export function [redacted](env = process.env, explicitValue) { L92: const candidate = explicitValue ?? Number.parseInt((env[CHECKPOINT_THRESHOLD_ENV] ?? "").trim(), 10); ... L332: try { L333: await exec(conn, "RETURN 1"); L334: return true;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/db/ladybug.jsView on unpkg · L90

Findings

1 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/scip/decoder-rust.js

MediumUnsafe Vm Contextdist/db/ladybug.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 13-53json

13 },

14 "bugs": {

15 "url": "https://github.com/GlitterKill/sdl-mcp/issues"

16 },

17 "homepage": "https://github.com/GlitterKill/sdl-mcp#readme",

18 "files": [

19 "dist",

20 "config",

21 "templates/*.json",

22 "templates/*.md",

23 "templates/*.template",

24 "scripts/postinstall.mjs",

25 "scripts/postinstall-watchman.mjs",

26 "scripts/postinstall-tree-sitter.mjs",

27 "scripts/postinstall-prune.mjs",

28 "scripts/postinstall-models.mjs",

29 "README.md",

30 "LICENSE"

31 ],

32 "scripts": {

33 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "clean:dist": "node scripts/clean-dist.mjs",

35 "build": "tsc -p tsconfig.build.json && node scripts/copy-ui-assets.mjs",

36 "build:scripts": "tsc -p tsconfig.scripts.json && node scripts/fix-imports.ts",

37 "build:runtime": "npm run clean:dist && npm run build",

38 "build:all": "npm run clean:dist && npm run build && npm run build:scripts",

39 "watch": "tsc -p tsconfig.build.json --watch",

40 "dev": "node src/main.ts",

41 "typecheck": "tsc --noEmit",

42 "lint": "eslint src",

43 "format": "prettier --write \"src/**/*.ts\"",

44 "test": "node scripts/run-tests.mjs",

45 "test:harness": "npm run test:adapters",

46 "test:adapters": "npm run build && npx tsc --rootDir tests/harness --outDir dist/tests/harness --module nodenext tests/harness/adapter-runner.ts && node dist/tests/harness/adapter-runner.js",

47 "test:golden": "npm run build && node scripts/golden/update-goldens.ts validate",

48 "golden:update": "npm run build && node scripts/golden/update-goldens.ts generate",

49 "benchmark:ci": "node dist/cli/index.js benchmark:ci",

50 "migrate": "npm run build:scripts && node dist/scripts/migrate.js",

51 "index": "npm run build:scripts && node dist/scripts/index-repo.js",

52 "index-repo": "npm run build:scripts && node dist/scripts/index-repo.js",

53 "dump-symbol": "npm run build:scripts && node dist/scripts/dump-symbol.js",

dist/scip/decoder-rust.jsView file

Lines 1-30javascript

1/**

2 * Rust-native SCIP decoder that wraps the napi-rs ScipDecodeHandle.

3 *

4 * Mirrors the native addon loading pattern from src/indexer/rustIndexer.ts.

5 * Falls back gracefully when the native addon is unavailable.

6 */

7import { createRequire } from "module";

8import { join } from "path";

9import { fileURLToPath } from

dist/db/ladybug.jsView file

Lines 70-110javascript

70 markExtensionLoaded(ext);

71 }

72 else {

73 markExtensionUnavailable(ext);

74 }

75 }

76}

77const require = createRequire(import.meta.url);