registry / synapse-rmcp / 0.6.1

synapse-rmcp@0.6.1

Node launcher for the Synapse Rust MCP server and CLI for Docker, host, SSH, log, ZFS, and file workflows.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 7.23 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 5-45json

5 "license": "MIT",

6 "homepage": "https://github.com/jmagar/synapse-rmcp#readme",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/jmagar/synapse-rmcp.git",

10 "directory": "packages/synapse-rmcp"

11 },

12 "bugs": {

13 "url": "https://github.com/jmagar/synapse-rmcp/issues"

14 },

15 "bin": {

16 "synapse": "bin/synapse.js"

17 },

18 "files": [

19 "bin/",

20 "lib/",

21 "scripts/",

22 "README.md"

23 ],

24 "scripts": {

25 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "test": "node --test",

27 "check": "node --check bin/synapse.js && node --check scripts/install.js && node --check lib/platform.js"

28 },

29 "engines": {

30 "node": ">=18"

31 },

32 "keywords": [

33 "mcp",

34 "mcp-server",

35 "model-context-protocol",

36 "rmcp",

37 "rust",

38 "cli",

39 "homelab",

40 "docker",

41 "docker-compose",

42 "ssh",

43 "zfs",

44 "logs",

45 "file-operations",

scripts/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const https = require("node:https");

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code