registry / vaaya-cli / 0.1.0

vaaya-cli@0.1.0

Vaaya CLI — give your agent paid superpowers. One command installs the Vaaya MCP server into Claude Code, Claude Desktop, Cursor, and Codex: media & video generation, product demo videos, web search & scraping, deep/market research, GTM & lead enrichment,

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.42 KB of source, external domains: vaaya.ai

Source & flagged code

3 flagged

bin/vaaya.mjsView file

Lines 1-63javascript

1#!/usr/bin/env node

2// vaaya — zero-dependency launcher for the Vaaya agent gateway.

3//

4// All real logic lives in @vaaya/mcp; this shim resolves and runs it via npx

5// pinned to @latest so every invocation uses the current release (npx's plain

6// cache-hit path would otherwise happily run a stale version forever).

8import { spawnSync } from 'node:child_process'

9import { createRequire } from 'node:module'

High

Child Process

Package source references child process execution.

bin/vaaya.mjsView on unpkg · L7

11const { version } = createRequire(import.meta.url)('../package.json')

13const HELP = `vaaya ${version} — give your agent paid superpowers (https://vaaya.ai)

15Usage

16 vaaya install Set up the Vaaya MCP server for every agent detected on

17 this machine (Claude Code, Claude Desktop, Cursor,

18 Codex). Idempotent — re-run any time to update.

19 vaaya status Show connection state and live tool count.

20 vaaya consult "..." Ask Vaaya how it would do something — returns the plan

21 (the exact calls an agent would run) without running them.

22 vaaya reauthorize Re-run the browser authorization flow.

23 vaaya logout Disconnect and delete local credentials.

24 vaaya serve Run the stdio MCP server (what agents invoke).

25 vaaya help Show this help.

27What agents get: media & video generation, product demo videos, web search &

34const KNOWN = new Set(['install', 'status', 'consult', 'reauthorize', 'logout', 'serve'])

36const [cmd, ...rest] = process.argv.slice(2)

38if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') {

39 console.log(HELP)

40 process.exit(0)

41}

42if (cmd === '--version' || cmd === '-v') {

43 console.log(version)

44 process.exit(0)

45}

46if (!KNOWN.has(cmd)) {

47 console.error(`vaaya: unknown command "${cmd}"\n`)

48 console.error(HELP)

49 process.exit(1)

50}

52// `serve` means "run the MCP stdio server", which is @vaaya/mcp's no-arg mode.

53const args = cmd === 'serve' ? rest : [cmd, ...rest]

54const result = spawnSync('npx', ['-y', '@vaaya/mcp@latest', ...args], {

55 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vaaya.mjsView on unpkg · L53

56 shell: process.platform === 'win32',

57})

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vaaya.mjsView on unpkg · L7

58if (result.error) {

59 console.error(`vaaya: failed to run @vaaya/mcp via npx: ${result.error.message}`)

60 process.exit(1)

61}

62process.exit(result.status ?? 0)

Source & flagged code

3 flagged · loading source

bin/vaaya.mjsView file

7L8: import { spawnSync } from 'node:child_process' L9: import { createRequire } from 'node:module'

High

Child Process

Package source references child process execution.

bin/vaaya.mjsView on unpkg · L7

7L8: import { spawnSync } from 'node:child_process' L9: import { createRequire } from 'node:module' L10: L11: const { version } = createRequire(import.meta.url)('../package.json') L12: L13: const HELP = `vaaya ${version} — give your agent paid superpowers (https://vaaya.ai) L14: ... L55: stdio: 'inherit', L56: shell: process.platform === 'win32', L57: })

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vaaya.mjsView on unpkg · L7

53const args = cmd === 'serve' ? rest : [cmd, ...rest] L54: const result = spawnSync('npx', ['-y', '@vaaya/mcp@latest', ...args], { L55: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vaaya.mjsView on unpkg · L53

Findings

4 High1 Medium2 Low

HighChild Processbin/vaaya.mjs

HighShell

HighSandbox Evasion Gated Capabilitybin/vaaya.mjs

HighRuntime Package Installbin/vaaya.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

Source & flagged code

3 flagged

bin/vaaya.mjsView file

Lines 1-63javascript

1#!/usr/bin/env node

2// vaaya — zero-dependency launcher for the Vaaya agent gateway.

3//

4// All real logic lives in @vaaya/mcp; this shim resolves and runs it via npx

5// pinned to @latest so every invocation uses the current release (npx's plain

6// cache-hit path would otherwise happily run a stale version forever).

8import { spawnSync } from 'node:child_process'

9import { createRequire } from 'node:module'

High

Child Process

Package source references child process execution.

bin/vaaya.mjsView on unpkg · L7

11const { version } = createRequire(import.meta.url)('../package.json')

13const HELP = `vaaya ${version} — give your agent paid superpowers (https://vaaya.ai)

15Usage

16 vaaya install Set up the Vaaya MCP server for every agent detected on

17 this machine (Claude Code, Claude Desktop, Cursor,

18 Codex). Idempotent — re-run any time to update.

19 vaaya status Show connection state and live tool count.

20 vaaya consult "..." Ask Vaaya how it would do something — returns the plan

21 (the exact calls an agent would run) without running them.

22 vaaya reauthorize Re-run the browser authorization flow.

23 vaaya logout Disconnect and delete local credentials.

24 vaaya serve Run the stdio MCP server (what agents invoke).

25 vaaya help Show this help.

27What agents get: media & video generation, product demo videos, web search &

34const KNOWN = new Set(['install', 'status', 'consult', 'reauthorize', 'logout', 'serve'])

36const [cmd, ...rest] = process.argv.slice(2)

38if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') {

39 console.log(HELP)

40 process.exit(0)

41}

42if (cmd === '--version' || cmd === '-v') {

43 console.log(version)

44 process.exit(0)

45}

46if (!KNOWN.has(cmd)) {

47 console.error(`vaaya: unknown command "${cmd}"\n`)

48 console.error(HELP)

49 process.exit(1)

50}

52// `serve` means "run the MCP stdio server", which is @vaaya/mcp's no-arg mode.

53const args = cmd === 'serve' ? rest : [cmd, ...rest]

54const result = spawnSync('npx', ['-y', '@vaaya/mcp@latest', ...args], {

55 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vaaya.mjsView on unpkg · L53

56 shell: process.platform === 'win32',

57})

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vaaya.mjsView on unpkg · L7

58if (result.error) {

59 console.error(`vaaya: failed to run @vaaya/mcp via npx: ${result.error.message}`)

60 process.exit(1)

61}

62process.exit(result.status ?? 0)