registry / wigolo / 0.1.43-beta.2

wigolo@0.1.43-beta.2

Local-first web intelligence MCP server for AI coding agents

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package performs user-invoked web research, optional local SearXNG Docker management, and explicit MCP configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit `wigolo` CLI/MCP use; agent configuration requires `wigolo setup mcp` or setup selection.

Impact

No install-time execution, credential harvesting, exfiltration, remote payload execution, or unconsented foreign agent-control mutation found.

Mechanism

Local web fetching/search, configured local plugin loading, and user-directed MCP integration.

Rationale

Direct inspection does not substantiate the scanner’s malicious label. Flagged primitives are explicit package features or defensive text/SSRF handling, with no concrete malicious chain.

Evidence

package.jsondist/index.jsdist/searxng/docker.jsdist/plugins/loader.jsdist/watch/ssrf.jsdist/extraction/site-extractors/amazon.jsdist/cli/setup-mcp.jsdist/cli/tui/config-writer.jsdist/cli/tui/config-writer-json.jsdist/cli/tui/config-writer-toml.jsdist/cli/tui/config-writer-cli.js

Network endpoints5

github.com/searxng/searxng/archive/refs/heads/master.tar.gzduckduckgo.com/api.search.brave.com/res/v1/web/searchapi.github.com/search/codeapi.semanticscholar.org/graph/v1/paper/search

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with high false-positive risk.

Evidence for block

Evidence against

`package.json` defines no preinstall/install/postinstall hooks.
`dist/index.js` activates setup, uninstall, Docker, and doctor functions only via explicit CLI commands.
`dist/watch/ssrf.js` blocks metadata hostnames, loopback, private, and link-local address ranges.
`dist/extraction/site-extractors/amazon.js` uses invisible characters only in a cleanup regex for scraped text.
`dist/plugins/loader.js` imports only plugins from the configured local plugins directory.
`dist/cli/tui/config-writer.js` adds a named wigolo MCP entry only for selected agents.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 370 file(s), 1.34 MB of source, external domains: 127.0.0.1, api.github.com, api.search.brave.com, api.semanticscholar.org, api.stackexchange.com, api2.marginalia-search.com, devdocs.io, developer.mozilla.org, duckduckgo.com, example.com, export.arxiv.org, github.com, hn.algolia.com, lite.duckduckgo.com, lobste.rs, news.ycombinator.com, python.org, twitter.com, www.bing.com, www.example.com, www.google.com, www.mojeek.com

Source & flagged code

7 flagged

dist/searxng/docker.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

3import { createLogger } from "../logger.js";

4const log = createLogger("searxng");

5const CONTAINER_NAME = "wigolo-searxng";

6const IMAGE = "searxng/searxng:latest";

7function isContainerRunning(name) {

8 try {

9 const result = execSync(

10 `docker inspect --format '{{.State.Running}}' -- ${shellEscape(name)}`,

11 { stdio: "pipe", encoding: "utf-8" }

12 ).trim();

13 return result === "true";

14 } catch {

15 return false;

16 }

17}

18function stopContainer(name) {

19 try {

20 const escaped = shellEscape(name);

21 execSync(`docker stop -- ${escaped} && docker rm -- ${escaped}`, { stdio: "pipe" });

dist/plugins/loader.jsView file

Lines 64-104javascript

64 }

65 continue;

66 }

67 if (!pkgJson.main) {

68 result.errors.push({

69 pluginName,

70 message: `plugin ${pluginName} has no main field in package.json`

71 });

72 continue;

dist/search/evidence.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

3import { countTokens, truncateByTokens } from "./tokens.js";

4import { applyOutputBudget } from "./truncate.js";

dist/watch/ssrf.jsView file

Lines 1-21javascript

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);

2const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([

3 "localhost",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.js

dist/extraction/site-extractors/amazon.jsView file

Lines 229-269javascript

229}

230function parseOverviewSpecifications(document) {

231 const out = /* @__PURE__ */ Object.create(null);

232 const rows = document.querySelectorAll("#productOverview_feature_div table tr");

dist/cli/doctor.jsView file

Lines 42-82javascript

42 return [

43 ` provider: ${provider} (key in ${location})`,

44 ` key (masked): ${masked}`

45 ];

46}

47function checkPython() {

48 const python = resolvePythonExe

Source & flagged code

7 flagged · loading source

dist/searxng/docker.jsView file

1import { execSync } from "node:child_process"; L2: import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

dist/plugins/loader.jsView file

84const fileUrl = pathToFileURL(entryPath).href; L85: mod = await import(fileUrl); L86: } catch (err) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/loader.jsView on unpkg · L84

dist/search/evidence.jsView file

1import { createHash } from "node:crypto"; L2: import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

dist/watch/ssrf.jsView file

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]); L2: const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([ L3: "localhost", ... L69: reason: `${fieldLabel} is not a valid URL`, L70: hint: 'Pass a fully qualified http(s) URL (e.g. "https://example.com/path").' L71: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.jsView on unpkg · L1

dist/extraction/site-extractors/amazon.jsView file

249contains invisible/control Unicode U+200D (zero width joiner) const cleaned = raw.replace(/[<U+200D><U+200E><U+200F><U+200B>]/g, "").trim();

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/extraction/site-extractors/amazon.jsView on unpkg · L249

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/cli/mcp.js -> dist/server.js -> dist/extraction/pipeline.js -> dist/extraction/v1/site-extractors.js -> dist/extraction/site-extractors/amazon.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/extraction/site-extractors/amazon.jsView on unpkg

dist/cli/doctor.jsView file

62try { L63: const r = spawnSync("npx", ["playwright", "--version"], { encoding: "utf-8", timeout: 5e3 }); L64: if (r.status === 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/doctor.jsView on unpkg · L62

Findings

2 Critical4 High4 Medium6 Low

CriticalTrojan Source Unicodedist/extraction/site-extractors/amazon.js

CriticalTrigger Reachable Dangerous Capabilitydist/extraction/site-extractors/amazon.js

HighChild Processdist/searxng/docker.js

HighShell

HighCloud Metadata Accessdist/watch/ssrf.js

HighRuntime Package Installdist/cli/doctor.js

MediumDynamic Requiredist/plugins/loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/search/evidence.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

93%Pass

Verdict confidence

IntentBenign

False-positive riskHigh

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTowhid Khan

Maintainersknockoutez

Version0.1.43-beta.2

PublishedJul 13, 2026

LicenseAGPL-3.0-only

Dependencies29

Integrityverified

Package size1.42 MB

Files1,500

Keywordsmcpmcp-serverweb-searchweb-scrapingai-agentlocal-firstcontent-extractionsearch

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/types.d.tsexports mapbin → wigolo

Runtimenode >=20

Artifact5.00 MB · 1,500 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: bench:agent, bench:embedding, bench:embedding:quality, bench:extraction +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsCopyleftLicense

Source & flagged code

7 flagged

dist/searxng/docker.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

3import { createLogger } from "../logger.js";

4const log = createLogger("searxng");

5const CONTAINER_NAME = "wigolo-searxng";

6const IMAGE = "searxng/searxng:latest";

7function isContainerRunning(name) {

8 try {

9 const result = execSync(

10 `docker inspect --format '{{.State.Running}}' -- ${shellEscape(name)}`,

11 { stdio: "pipe", encoding: "utf-8" }

12 ).trim();

13 return result === "true";

14 } catch {

15 return false;

16 }

17}

18function stopContainer(name) {

19 try {

20 const escaped = shellEscape(name);

21 execSync(`docker stop -- ${escaped} && docker rm -- ${escaped}`, { stdio: "pipe" });

dist/plugins/loader.jsView file

Lines 64-104javascript

64 }

65 continue;

66 }

67 if (!pkgJson.main) {

68 result.errors.push({

69 pluginName,

70 message: `plugin ${pluginName} has no main field in package.json`

71 });

72 continue;

dist/search/evidence.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

3import { countTokens, truncateByTokens } from "./tokens.js";

4import { applyOutputBudget } from "./truncate.js";

dist/watch/ssrf.jsView file

Lines 1-21javascript

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);

2const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([

3 "localhost",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.js

dist/extraction/site-extractors/amazon.jsView file

Lines 229-269javascript

229}

230function parseOverviewSpecifications(document) {

231 const out = /* @__PURE__ */ Object.create(null);

232 const rows = document.querySelectorAll("#productOverview_feature_div table tr");

dist/cli/doctor.jsView file

Lines 42-82javascript

42 return [

43 ` provider: ${provider} (key in ${location})`,

44 ` key (masked): ${masked}`

45 ];

46}

47function checkPython() {

48 const python = resolvePythonExe