registry / typegraph-mcp / 0.9.45

typegraph-mcp@0.9.45

Type-aware codebase navigation for AI coding agents — 14 MCP tools powered by tsserver + oxc

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 585 KB of source, external domains: json.schemastore.org

Source & flagged code

4 flagged

tsserver-client.tsView file

Lines 1-30typescript

1/**

2 * TsServerClient — TypeScript Server Protocol Bridge

3 *

4 * Spawns tsserver as a child process and provides a typed async API

5 * for sending commands and receiving responses.

6 *

7 * Protocol: tsserver uses Content-Length framed JSON over stdin/stdout.

8 * Requests are newline-terminated JSON. Responses are matched by request_seq.

9 */

11import { spawn, type ChildProcess } from "node:child_process";

12import * as path from "node:path";

High

Child Process

Package source references child process execution.

tsserver-client.tsView on unpkg · L10

13import * as fs from "node:fs";

14import { createRequire } from "node:module";

16// ─── Types ───────────────────────────────────────────────────────────────────

18export interface Location {

19 line: number;

20 offset: number;

21}

23export interface DefinitionResult {

24 file: string;

25 start: Location;

26 end: Location;

27 contextStart?: Location;

28 contextEnd?: Location;

29}

dist/check.jsView file

Lines 103-143javascript

103 if (distIdx === -1) return resolvedPath;

104 const prefix = rel.slice(0, distIdx);

105 const afterDist = rel.slice(distIdx + 5);

106

cli.tsView file

Lines 1029-1069typescript

1029 if (selectedAgents.includes("claude-code")) {

1030 const mcpConfig = {

1031 mcpServers: {

1032 typegraph: {

1033 command: process.execPath,

1034 args: ["${CLAUDE_PLUGIN_ROOT}/node_modules/tsx/dist/cli.mjs", "${CLAUDE_PLUGIN_ROOT}/server.ts"],

1035 env: {

1036

scripts/ensure-deps.shView file

•path = scripts/ensure-deps.sh kind = build_helper sizeBytes = 1033 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ensure-deps.shView on unpkg

Source & flagged code

4 flagged · loading source

tsserver-client.tsView file

10L11: import { spawn, type ChildProcess } from "node:child_process"; L12: import * as path from "node:path";

High

Child Process

Package source references child process execution.

tsserver-client.tsView on unpkg · L10

dist/check.jsView file

123} L124: function resolveProjectImport(resolver, fromDir, specifier, projectRoot) { L125: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/check.jsView on unpkg · L123

cli.tsView file

1049try { L1050: execSync("npm install --include=optional", { cwd: targetDir, stdio: "pipe" }); L1051: s.stop(`${isUpdate ? "Updated" : "Installed"} ${copied} files with dependencies`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.tsView on unpkg · L1049

scripts/ensure-deps.shView file

•path = scripts/ensure-deps.sh kind = build_helper sizeBytes = 1033 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ensure-deps.shView on unpkg

Findings

3 High4 Medium4 Low

HighChild Processtsserver-client.ts

HighShell

HighRuntime Package Installcli.ts

MediumDynamic Requiredist/check.js

MediumEnvironment Vars

MediumShips Build Helperscripts/ensure-deps.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

tsserver-client.tsView file

Lines 1-30typescript

1/**

2 * TsServerClient — TypeScript Server Protocol Bridge

3 *

4 * Spawns tsserver as a child process and provides a typed async API

5 * for sending commands and receiving responses.

6 *

7 * Protocol: tsserver uses Content-Length framed JSON over stdin/stdout.

8 * Requests are newline-terminated JSON. Responses are matched by request_seq.

9 */

11import { spawn, type ChildProcess } from "node:child_process";

12import * as path from "node:path";

High

Child Process

Package source references child process execution.

tsserver-client.tsView on unpkg · L10

13import * as fs from "node:fs";

14import { createRequire } from "node:module";

18export interface Location {

19 line: number;

20 offset: number;

21}

23export interface DefinitionResult {

24 file: string;

25 start: Location;

26 end: Location;

27 contextStart?: Location;

28 contextEnd?: Location;

29}

dist/check.jsView file

Lines 103-143javascript

103 if (distIdx === -1) return resolvedPath;

104 const prefix = rel.slice(0, distIdx);

105 const afterDist = rel.slice(distIdx + 5);

106

cli.tsView file

Lines 1029-1069typescript

1029 if (selectedAgents.includes("claude-code")) {

1030 const mcpConfig = {

1031 mcpServers: {

1032 typegraph: {

1033 command: process.execPath,

1034 args: ["${CLAUDE_PLUGIN_ROOT}/node_modules/tsx/dist/cli.mjs", "${CLAUDE_PLUGIN_ROOT}/server.ts"],

1035 env: {

1036

scripts/ensure-deps.shView file

•path = scripts/ensure-deps.sh kind = build_helper sizeBytes = 1033 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ensure-deps.shView on unpkg