registry / suppa-mcp-2 / 1.12.0

suppa-mcp-2@1.12.0

MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 732 KB of source, external domains: accounts.google.com, blocked.invalid, modern.suppa.me, registry.npmjs.org, sp.modern-expo.com

Source & flagged code

3 flagged

dist/tools/entityCode.jsView file

Lines 22-62javascript

22 for (const root of [join(here, "..", ".."), join(here, "..", "..", "..")]) {

23 const p = join(root, "skills", "suppa-entity-code", "scripts", name);

24 if (existsSync(p))

25 return p;

26 }

27 return null;

28}

29function validatorPath() {

30 return skillScript("validate-suppa-schema.mjs");

31}

32/**

33 * What the gate blocks on, read from the file that defines the rules rather than

34 * restated here. A hand-written list understated it: it named four rules while

35 * the checker blocked on seven, so an agent whose run failed on a code the note

36 * never mentioned could reasonably read the failure as advisory.

37 */

38async function blockingSummary() {

39 const p = skillScript("house-rules.mjs");

40 if (!p)

41 return "the house rules in skills/suppa-entity-code/SKILL.md";

42 try {

43 const mod = await import(pathToFileURL(p).href);

44 return String(mod.BLOCKING_SUMMARY ?? "").trim() || "the house rules in SKILL.md";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/entityCode.jsView on unpkg · L42

45 }

46 catch {

47 return "the house rules in skills/suppa-entity-code/SKILL.md";

48 }

49}

50/**

51 * Run the schema gate over an application repo (or a single file).

52 *

53 * `path` is an app root — the whole repo is walked, which is also what lets the

54 * unreferenced-enum-name rule speak, since it argues from absence and needs to

55 * see every file that could hold a reference.

56 */

57export async function validateEntityCode(path, strict = true) {

58 const target = String(path ?? "").trim();

59 if (!target) {

60 return jsonResponse({

61 error: "path is required — give the application repo's root (preferred: the whole repo is checked, " +

62 "and the enum-name rule needs that) or one *.entity.ts / *.seed.ts file.",

dist/version.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/version.js: * node_modules holds; publishing a fix changes nothing until that client is import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; writeFileSync(tmp, `${JSON.stringify(cache, null, 2)}\n`, "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/version.jsView on unpkg

skills/suppa-entity-code/scripts/install-entity-code-guards.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rltopath } from "node:url"; const here = dirname(fileurltopath(import.meta.url)); const guard = join(here, "entity-code-guard.mjs"); const agents_template = join(here, "..", "templates", "agents.entity-code.md"); const begin = ""; const end = ""; const args = process.argv.slice(2); const dryrun = args.includes("--dry-run"); const nogit = args.includes("--no-git"); const root = resolve(args.find((a) => !a.startswith("--")) ?? process.cwd()); const done = []; const skipped = []; function write(path, content) { if (dryrun) { done.push(`would write ${relative(root, path) || path}`)

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

skills/suppa-entity-code/scripts/install-entity-code-guards.mjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/tools/entityCode.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code