Loading npm security reports…
suppa-mcp-2@1.43.3: Agent extension lifecycle risk – flagged | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
suppa-mcp-2@1.43.3 MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.
scanned 2d ago · by lpm-firewall-ai The postinstall automatically configures project-level agent hooks and instruction files, so a warning is warranted for first-party agent extension setup. Its project checks and opt-out constrain the behavior, and the inspected source did not establish a separate malicious attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm in a non-CI, non-global project that contains Suppa schema code or a Suppa dependency, unless the opt-out is set.
Impact
Agent writes to schema files may be checked or blocked, and project agent configuration is modified automatically.
Mechanism
The postinstall invokes an installer that updates Claude project settings, agent instruction files, and related schema-check configuration.
AI rationale
The postinstall automatically configures project-level agent hooks and instruction files, so a warning is warranted for first-party agent extension setup. Its project checks and opt-out constrain the behavior, and the inspected source did not establish a separate malicious attack.
Evidence
package.json skills/suppa-entity-code/scripts/postinstall.mjs skills/suppa-entity-code/scripts/install-entity-code-guards.mjs skills/suppa-entity-code/scripts/entity-code-guard.mjs .claude/settings.json AGENTS.md CLAUDE.md .githooks/pre-commit .gitlab/suppa-schema-gate.yml
public snapshot AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
package.json runs the guard installer from its postinstall hook. The postinstall skips CI and global installs, supports an opt-out, and only proceeds for a project with Suppa schema code or a Suppa dependency. The installer adds callbacks to the project’s Claude settings and adds managed sections to agent instruction files. Those callbacks run around agent file writes and can gate completion when changed schema files fail validation. Evidence against
The setup is limited to projects identified as using Suppa schema code and can be disabled with SUPPA_NO_GUARD_INSTALL. The installed guard is focused on Suppa entity and seed schema files; no credential collection or unrelated network transfer was identified in the inspected setup code. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network
Supply chain HighEntropyStrings
11 flagged · loading source • scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node skills/suppa-entity-code/scripts/postinstall.mjs
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg skills/suppa-form-v2/scripts/vue-compiler-diagnostics.mjs View file 9 `,-1),e.hoists.length)){let f=[At,Ct,Xe,Rt,Cn].filter(h=>p.includes(h)).map(Wn).join(", ");i(`const { ${f} } = _Vue
L10: `,-1)}Ni(e.hoists,t),r(),i("return ")}function Et(e,t,{helper:n,push:s,newline:i,isTS:r}){let o=n(t==="filter"?Pt:t==="component"?Dt:Lt);for(let a=0;a<e.length;a++){let l=e[a],c=l....
L11: /*! Bundled license information:
7 High 5 Medium 7 Low
High Install Time Lifecycle Scripts package.json
High Sandbox Evasion Gated Capability dist/config.js
High Semantic Analysis Limited dist/selfcheck.js#virtual:normalized:round1
High Known Malware Source Similarity dist/auth.js
High Known Malware Source Similarity skills/suppa-entity-code/scripts/validate-suppa-schema.mjs
High Known Malware Source Similarity dist/selfcheck.js
High Known Malware Source Similarity skills/suppa-form-v2/scripts/card-kit/card-kit.mjs
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist/tools/entityCode.js
Medium Network
Medium Environment Vars
Medium
Affected versions and remediation This report applies to suppa-mcp-2@1.43.3 .
See all versions of suppa-mcp-2 for other recorded verdicts.
Review the evidence and your use of suppa-mcp-2@1.43.3 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-21 07:07:00.967Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
92% Suspicious
AI assessment confidence
Package metadata npm Maintainers taniant
Version 1.43.3
Latest on npm 1.43.5
Published Oct 21, 2026
License MIT
Dependencies 3
Integrity verified
Package size 1.26 MB
Files 137
Keywords mcp model-context-protocol suppa modern-expo ai llm tools claude
Minified
PossibleObfuscation
UrlStrings
Manifest No manifest risk signals triggered.
scanned 70 file(s), 3.27 MB of source, external domains: accounts.google.com, blocked.invalid, modern.suppa.me, modern2.suppa.me, registry.npmjs.org, service.example.com, sp.modern-expo.com, v3-migration.vuejs.org, vuejs.org
Eval
Package source references a known benign dynamic code generation pattern.
skills/suppa-form-v2/scripts/vue-compiler-diagnostics.mjs View on unpkg · L9 81 try {
L82: const mod = await import(pathToFileURL(p).href);
L83: return String(mod.BLOCKING_SUMMARY ?? "").trim() || "the house rules in SKILL.md";
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/tools/entityCode.js View on unpkg · L81 53 const key = createHash("sha1").update(`${host}|${route}`).digest("hex");
L54: return join(homeDir(), "cache", "db-stats", `${key}.json`);
L55: }
...
L67: async call(method, path, body, query, cache = false) {
L68: const route = query ? `${path}?${new URLSearchParams(Object.entries(query).map(([k, v]) => [k, String(v)])).toString()}` : path;
L69: if (cache && this.useCache) {
...
L72: if (Date.now() - statSync(file).mtimeMs < CACHE_TTL_MS) {
L73: const json = JSON.parse(readFileSync(file, "utf-8"));
L74: this.cached += 1;
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/tools/queryAnalyze.js View on unpkg · L53 17 const candidates = [];
L18: const cwd = process.cwd();
L19: // cwd, then every parent up to the filesystem root (mirrors Path.cwd().parents).
...
L30: // this is Path(__file__).resolve().parent.parent.parent; here we walk up from
L31: // the compiled module location to the package root (the dir with package.json).
L32: const packageRoot = findPackageRoot(dirname(fileURLToPath(import.meta.url)));
...
L79: value = stripQuotes(value);
L80: if (key.startsWith("SUPPA_") && !(key in process.env)) {
L81: process.env[key] = value;
...
L115: loadDotenv();
L116: const BASE_URL = (process.env.SUPPA_BASE_URL || "https://modern.suppa.me").replace(/\/+$/, "");
L117: const API_KEY = process.env.SUPPA_API_KEY || process.env.SUPPA_TOKEN || "";
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/config.js View on unpkg · L17 dist/selfcheck.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/selfcheck.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = dist/auth.js
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/auth.js View on unpkg skills/suppa-entity-code/scripts/validate-suppa-schema.mjs View file • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = skills/suppa-entity-code/scripts/validate-suppa-schema.mjs
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/suppa-entity-code/scripts/validate-suppa-schema.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = dist/selfcheck.js
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/selfcheck.js View on unpkg skills/suppa-form-v2/scripts/card-kit/card-kit.mjs View file • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = skills/suppa-form-v2/scripts/card-kit/card-kit.mjs
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/suppa-form-v2/scripts/card-kit/card-kit.mjs View on unpkg Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Eval skills/suppa-form-v2/scripts/vue-compiler-diagnostics.mjs
Low Weak Crypto dist/tools/queryAnalyze.js
package.json
Entrypoints main → dist/bin.js bin → suppa, suppa-entity-guards, suppa-mcp +1
Runtime node >=18
Artifact 4.59 MB · 137 files 2 signature(s)
Install lifecycle postinstall prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network HighEntropyStrings Minified PossibleObfuscation UrlStrings Manifest: clean
11 flagged Lines 14-54 json
29 "clean" : "node -e \" require('fs').rmSync('dist',{recursive:true,force:true}) \" " ,
30 "rebuild" : "npm run clean && npm run build" ,
31 "start" : "node dist/bin.js" ,
33 "test" : "node scripts/check-version-literals.mjs && vitest run" ,
34 "postinstall" : "node skills/suppa-entity-code/scripts/postinstall.mjs" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L34 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L34 35 "test:watch" : "vitest" ,
36 "prepublishOnly" : "npm run rebuild && npm test" ,
37 "inspect" : "npx @modelcontextprotocol/inspector node dist/bin.js" ,
38 "live:install" : "node scripts/live-install.mjs" ,
39 "live:verify" : "node scripts/verify-live-install.mjs" ,
40 "schema:gate" : "node skills/suppa-entity-code/scripts/entity-code-guard.mjs --ci ." ,
41 "form:gate" : "node skills/suppa-form-v2/scripts/validate-form-schema.mjs" ,
42 "sync:formbuilder" : "node scripts/sync-formbuilder.mjs" ,
43 "sync:vue-compiler" : "node scripts/sync-vue-compiler.mjs" ,
44 "guards:install" : "node skills/suppa-entity-code/scripts/install-entity-code-guards.mjs"
48 "model-context-protocol" ,
skills/suppa-form-v2/scripts/vue-compiler-diagnostics.mjs View file Lines 1-29 javascript
1 // @vue/compiler-dom 3.5.12, esm-bundler build, NODE_ENV=development (MIT, (c) Evan You and Vue contributors), bundled by scripts/sync-vue-compiler.mjs. Do not edit.
2 function J ( e ){ let t = Object. create ( null ); for ( let n of e. split ( "," ))t[n]
Lines 33-73 javascript
33 export const MAX_ROLE_PLANS = 2 ;
34 const CACHE_TTL_MS = 30 * 60 * 1000 ;
Lines 1-37 javascript
2 * Configuration loaded from environment variables or .env file.
4 * Faithful 1:1 port of the Python `suppa_mcp/config.py`.
6 import { existsSync, readFileSync, statSync } from "node:fs" ;
7 import { dirname, join, resolve } from "node:path" ;
dist/selfcheck.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/selfcheck.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = dist/auth.js
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/auth.js View on unpkg skills/suppa-entity-code/scripts/validate-suppa-schema.mjs View file • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = skills/suppa-entity-code/scripts/validate-suppa-schema.mjs
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/suppa-entity-code/scripts/validate-suppa-schema.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = dist/selfcheck.js
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/selfcheck.js View on unpkg skills/suppa-form-v2/scripts/card-kit/card-kit.mjs View file • matchType = normalized_sha256
matchedPackage = suppa-mcp-2@1.43.0
matchedPath = skills/suppa-form-v2/scripts/card-kit/card-kit.mjs
matchedIdentity = npm:c3VwcGEtbWNwLTI:1.43.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/suppa-form-v2/scripts/card-kit/card-kit.mjs View on unpkg =
1
;
return
n
=>
n
in
t}
var
zt
=
Object.
freeze
({}),Cr
=
Object.
freeze
([]),
je
=
()
=>
{},
Me
=
()
=>!
1
,
Ke
=
e
=>
e.
charCodeAt
(
0
)
===
111
&&
e.
charCodeAt
(
1
)
===
110
&&
(e.
charCodeAt
(
2
)
>
122
||
e.
charCodeAt
(
2
)
<
97
);
var
ee
=
Object.assign;
var
te
=
Array.isArray;
var
w
=
e
=>typeof
e
==
"string"
,
qe
=
e
=>typeof
e
==
"symbol"
,
Qt
=
e
=>
e
!==
null
&&typeof
e
==
"object"
;
var
ht
=
J
(
",key,ref,ref_for,ref_key,onVnodeBeforeMount,onVnodeMounted,onVnodeBeforeUpdate,onVnodeUpdated,onVnodeBeforeUnmount,onVnodeUnmounted"
),Zt
=
J
(
"bind,cloak,else-if,else,for,html,if,model,on,once,pre,show,slot,text,m ..
.
3 Details: ${o} `:""}` ,l =new SyntaxError (a);l.code = e,n && (l.loc = n),t. onWarn (l)} function Ht ( e ){ throw e} function Pn ( e ){console. warn ( `[Vue warn] ${ e . message }` )} function b ( e , t , n , s ){ let i = (n || Us)[e] + (s || "" ),r =new SyntaxError ( String (i)); return r.code = e,r.loc = t,r}var Us = { 0 : "Illegal comment." , 1 : "CDATA section is allowed only in XML context." , 2 : "Duplicate attribute." , 3 : "End tag cannot have attributes." , 4 : "Illegal '/' in tags." , 5 : "Unexpected EOF in tag." , 6 : "Unexpected EOF in CDATA section." , 7 : "Unexpected EOF in comment." , 8 : "Unexpected EOF in script." , 9 : "Unexpected EOF in tag." , 10 : "Incorrectly closed comme .. .
4 Use a v - bind binding combined with a v - on listener that emits update:x event instead. `,45:"Error parsing JavaScript expression: ",46:"<KeepAlive> expects exactly one child component.",51:"@vnode-* hooks in templates are no longer supported. Use the vue: prefix instead. For example, @vnode-mounted should be changed to @vue:mounted. @vnode-* hooks support has been removed in 3.4.",47:'"prefixIdentifiers" option is not supported in this build of compiler.',48:"ES module mode is not supported in this build of compiler.",49:'"cacheHandlers" option is only supported when the "prefixIdentifiers" opti ...
5 ` );else if ( ri (r.content)){let o = e[i - 1 ] && e[i - 1 ].type,a = e[i + 1 ] && e[i + 1 ].type; ! o ||! a || n && (o === 3 && (a === 3 || a === 1 ) || o === 1 && (a === 3 || a === 1 && oi (r.content))) ? (s =! 0 ,e[i] = null ) : r.content = " " }else n && (r.content = Hn (r.content))}return s ? e. filter (Boolean) : e} function ri ( e ){ for ( let t = 0 ;t < e. length ;t ++ ) if ( ! Y (e. charCodeAt (t))) return! 1 ; return! 0 } function oi ( e ){ for ( let t = 0 ;t < e. length ;t ++ ){ let n = e. charCodeAt (t); if (n === 10 || n === 13 ) return! 0 } return! 1 } function Hn ( e ){ let t = "" ,n =! 1 ; for ( let s = 0 ;s < e. length ;s ++ ) Y (e. charCodeAt (s)) ? n || (t += " " ,n =! 0 ) : (t += e[s],n =! 1 ); return t} function Ot ( e ){( D [ 0 ] || Ue).children. push (e)} function P ( e , t ){ ...
6 `+" ".repeat(m),0)}return u}function _i(e,t={}){let n=mi(e,t);t.onContextCreated&&t.onContextCreated(n);let{mode:s,push:i,prefixIdentifiers:r,indent:o,deindent:a,newline:l,scopeId:c,ssr:p}=n,f=Array.from(e.helpers),h=f.length>0,u=!r&&s!=="module";gi(e,n);let m=p?"ssrRender":"render",_=(p?["_ctx","_push","_parent","_attrs"]:["_ctx","_cache"]).join(", ");if(i(` function $ {m}(${_}) { `),o(),u&&(i("with (_ctx) {"),o(),h&&(i(` const { $ { f . map ( Wn ). join (", ")} } = _Vue
7 `,-1),l())),e.components.length&&(Et(e.components,"component",n),(e.directives.length||e.temps>0)&&l()),e.directives.length&&(Et(e.directives,"directive",n),e.temps>0&&l()),e.filters&&e.filters.length&&(l(),Et(e.filters,"filter",n),l()),e.temps>0){i("let ");for(let A=0;A<e.temps;A++)i(` ${ A > 0 ? ", " : "" }_temp${ A } `)}return(e.components.length||e.directives.length||e.temps)&&(i(`
8 `,0),l()),p||i("return "),e.codegenNode?B(e.codegenNode,n):i("null"),u&&(a(),i("}")),a(),i("}"),{ast:e,code:n.code,preamble:"",map:n.map?n.map.toJSON():void 0}}function gi(e,t){let{ssr:n,prefixIdentifiers:s,push:i,newline:r,runtimeModuleName:o,runtimeGlobalName:a,ssrRuntimeModuleName:l}=t,c=a,p=Array.from(e.helpers);if(p.length>0&&(i(` const _Vue = ${c}
9 `,-1),e.hoists.length)){let f=[At,Ct,Xe,Rt,Cn].filter(h=>p.includes(h)).map(Wn).join(", ");i(` const { $ { f } } = _Vue
10 `,-1)}Ni(e.hoists,t),r(),i("return ")}function Et(e,t,{helper:n,push:s,newline:i,isTS:r}){let o=n(t==="filter"?Pt:t==="component"?Dt:Lt);for(let a=0;a<e.length;a++){let l=e[a],c=l.endsWith("__self");c&&(l=l.slice(0,-6)),s(` const $ {Fe(l, t )} = ${o}(${JSON.stringify(l)}${c? ", true" : "" })${r ? "!" : "" } `),a<e.length-1&&i()}}function Ni(e,t){if(!e.length)return;t.pure=!0;let{push:n,newline:s}=t;s();for(let i=0;i<e.length;i++){let r=e[i];r&&(n(` const _hoisted_$ {i+1} = `),B(r,t),s())}t.pure=!1}function Si(e){return w(e)||e.type===4||e.type===2||e.type===5||e.type===8}function jt(e,t){let n=e.length>3||e.s ...
11 /*! Bundled license information:
Low Eval
Package source references a known benign dynamic code generation pattern.
skills/suppa-form-v2/scripts/vue-compiler-diagnostics.mjs View on unpkg · L9 13 @vue/shared/dist/shared.esm-bundler.js:
16 * (c) 2018-present Yuxi (Evan) You and Vue contributors
19 (*! #__NO_SIDE_EFFECTS__ *)
21 @vue/compiler-core/dist/compiler-core.esm-bundler.js:
23 * @vue/compiler-core v3.5.12
24 * (c) 2018-present Yuxi (Evan) You and Vue contributors
28 @vue/compiler-dom/dist/compiler-dom.esm-bundler.js:
Long lines were clipped for display.
68 function validatorPath () {
69 return skillScript ( "validate-suppa-schema.mjs" );
72 * What the gate blocks on, read from the file that defines the rules rather than
73 * restated here. A hand-written list understated it: it named four rules while
74 * the checker blocked on seven, so an agent whose run failed on a code the note
75 * never mentioned could reasonably read the failure as advisory.
77 async function blockingSummary () {
78 const p = skillScript ( "house-rules.mjs" );
80 return "the house rules in skills/suppa-entity-code/SKILL.md" ;
82 const mod = await import ( pathToFileURL (p).href);
83 return String (mod. BLOCKING_SUMMARY ?? "" ). trim () || "the house rules in SKILL.md" ;
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/tools/entityCode.js View on unpkg · L81 86 return "the house rules in skills/suppa-entity-code/SKILL.md" ;
90 * Run the schema gate over an application repo (or a single file).
92 * `path` is an app root — the whole repo is walked, which is also what lets the
93 * unreferenced-enum-name rule speak, since it argues from absence and needs to
94 * see every file that could hold a reference.
97 * Is the validator USABLE, not merely present?
99 * existsSync cannot tell a working checker from a truncated one, and the difference only shows up
100 * when someone runs the gate — measured: a 300-byte validate-suppa-schema.mjs still reported
101 * "present" while the guard refused to run.
const
TIMEOUT_S
=
35
;
36 /** A role worth a detailed plan: this much costlier than full rights, or one of these codes. */
37 const ROLE_DETAIL_RATIO = 3 ;
38 const ROLE_DETAIL_CODES = new Set ([
39 "ACCESS_RULES_DOMINATE" ,
40 "PER_ROW_ACCESS_CHECK" ,
41 "FULL_SCAN_SELECTIVE_FILTER" ,
42 "INDEX_SCAN_HEAVY_FILTER" ,
43 "JOIN_KEY_NOT_INDEXED" ,
45 const SEVERITY_RANK = { critical: 0 , warning: 1 , info: 2 };
46 const KIND_RANK = [ "role-refused" , "create" , "create-if-needed" , "rebuild" , "drop" , "drop-after-create" , "rewrite" , "make-partial" , "disable-search" , "review" , "observe" ];
47 const NOTHING_SENT = "Nothing was sent." ;
48 class Stop extends Error {
50 // ── HTTP with a budget ───────────────────────────────────────────────────────
51 /** Where /db-stats answers are kept between runs — the CLI is one process per call. */
52 function cacheFile ( host , route ) {
53 const key = createHash ( "sha1" ). update ( `${ host }|${ route }` ). digest ( "hex" );
54 return join ( homeDir (), "cache" , "db-stats" , `${ key }.json` );
62 constructor ( host , useCache ) {
64 this .useCache = useCache;
66 /** One request, counted. `route` is relative to /api/core and carries its query string for the log and the cache key. */
67 async call ( method , path , body , query , cache = false ) {
68 const route = query ? `${ path }?${ new URLSearchParams ( Object . entries ( query ). map (([ k , v ]) => [ k , String ( v )])). toString () }` : path;
69 if (cache && this .useCache) {
71 const file = cacheFile ( this .host, route);
72 if (Date. now () - statSync (file).mtimeMs < CACHE_TTL_MS ) {
73 const json = JSON . parse ( readFileSync (file, "utf-8" ));
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/tools/queryAnalyze.js View on unpkg · L53 import
{ fileURLToPath }
from
"node:url"
;
10 * Return candidate .env locations, in priority order.
12 * Searches the current working directory and every parent up to the
13 * filesystem root, then the packaged project root. This makes the server
14 * work no matter which directory an MCP client launches it from.
16 export function candidateEnvFiles () {
17 const candidates = [];
18 const cwd = process. cwd ();
19 // cwd, then every parent up to the filesystem root (mirrors Path.cwd().parents).
20 let folder = resolve (cwd);
22 candidates. push ( join (folder, ".env" ));
23 const parent = dirname (folder);
24 if (parent === folder) {
25 break ; // reached the filesystem root
29 // Project root relative to this module (…/suppa-mcp-node/.env). In Python
30 // this is Path(__file__).resolve().parent.parent.parent; here we walk up from
31 // the compiled module location to the package root (the dir with package.json).
32 const packageRoot = findPackageRoot ( dirname ( fileURLToPath ( import . meta .url)));
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/config.js View on unpkg · L17 33 candidates. push ( join (packageRoot, ".env" ));
34 // De-duplicate while preserving order.
35 const seen = new Set ();
37 for ( const c of candidates) {