registry / twining-mcp / 1.23.0

twining-mcp@1.23.0

Agent coordination MCP server and Claude Code plugin — shared blackboard, decision tracking, and context assembly

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 77 file(s), 2.55 MB of source, external domains: 127.0.0.1, momentjs.com, us.i.posthog.com

Source & flagged code

1 flagged

dist/analytics/telemetry-client.jsView file

Lines 1-34javascript

1/**

2 * PostHog telemetry client — opt-in anonymous usage data.

3 *

4 * Privacy safeguards:

5 * - Disabled by default, requires explicit config opt-in

6 * - Respects DO_NOT_TRACK=1 and CI=true env vars

7 * - Identity: SHA-256 hash of hostname + projectRoot (never raw)

8 * - Never sends: file paths, decision content, agent names, error messages, env vars

9 * - Dynamic import of posthog-node — graceful no-op if not installed

10 * - Non-blocking: fire-and-forget, silent on network failure

11 */

12import { createHash } from "node:crypto";

13import os from "node:os";

14import { POSTHOG_API_KEY as BAKED_POSTHOG_KEY } from "./_generated-posthog-key.js";

15const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";

16export class TelemetryClient {

17 client = null;

18 distinctId = "";

19 enabled = false;

20 /** Initialize telemetry. Returns true if enabled and ready. */

21 async init(config, projectRoot, version) {

22 // Gate: disabled by default

23 if (!config?.telemetry?.enabled)

24 return false;

25 // Gate: respect DO_NOT_TRACK

26 if (process.env.DO_NOT_TRACK === "1")

27 return false;

28 // Gate: auto-disable in CI

29 if (process.env.CI === "true")

30 return false;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/analytics/telemetry-client.jsView on unpkg · L14

31 // Priority: env var > config file > build-time baked key

32 const apiKey = process.env.POSTHOG_API_KEY || config.telemetry.posthog_api_key || BAKED_POSTHOG_KEY;

33 const host = config.telemetry.posthog_host || DEFAULT_POSTHOG_HOST;

34 if (!apiKey)

Source & flagged code

1 flagged · loading source

dist/analytics/telemetry-client.jsView file

14import { POSTHOG_API_KEY as BAKED_POSTHOG_KEY } from "./_generated-posthog-key.js"; L15: const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; L16: export class TelemetryClient { ... L25: // Gate: respect DO_NOT_TRACK L26: if (process.env.DO_NOT_TRACK === "1") L27: return false; L28: // Gate: auto-disable in CI L29: if (process.env.CI === "true") L30: return false; ... L37: this.distinctId = createHash("sha256") L38: .update(os.hostname() + projectRoot) L39: .digest("hex")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/analytics/telemetry-client.jsView on unpkg · L14

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/analytics/telemetry-client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/analytics/telemetry-client.jsView file

Lines 1-34javascript

1/**

2 * PostHog telemetry client — opt-in anonymous usage data.

3 *

4 * Privacy safeguards:

5 * - Disabled by default, requires explicit config opt-in

6 * - Respects DO_NOT_TRACK=1 and CI=true env vars

7 * - Identity: SHA-256 hash of hostname + projectRoot (never raw)

8 * - Never sends: file paths, decision content, agent names, error messages, env vars

9 * - Dynamic import of posthog-node — graceful no-op if not installed

10 * - Non-blocking: fire-and-forget, silent on network failure

11 */

12import { createHash } from "node:crypto";

13import os from "node:os";

14import { POSTHOG_API_KEY as BAKED_POSTHOG_KEY } from "./_generated-posthog-key.js";

15const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";

16export class TelemetryClient {

17 client = null;

18 distinctId = "";

19 enabled = false;

20 /** Initialize telemetry. Returns true if enabled and ready. */

21 async init(config, projectRoot, version) {

22 // Gate: disabled by default

23 if (!config?.telemetry?.enabled)

24 return false;

25 // Gate: respect DO_NOT_TRACK

26 if (process.env.DO_NOT_TRACK === "1")

27 return false;

28 // Gate: auto-disable in CI

29 if (process.env.CI === "true")

30 return false;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/analytics/telemetry-client.jsView on unpkg · L14

31 // Priority: env var > config file > build-time baked key

32 const apiKey = process.env.POSTHOG_API_KEY || config.telemetry.posthog_api_key || BAKED_POSTHOG_KEY;

33 const host = config.telemetry.posthog_host || DEFAULT_POSTHOG_HOST;

34 if (!apiKey)