registry / wigolo / 0.1.39-beta.0

wigolo@0.1.39-beta.0

Local-first web intelligence MCP server for AI coding agents

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. The package is an MCP/web intelligence CLI with user-invoked setup, warmup, crawling, local cache, and optional plugin behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs wigolo CLI commands such as setup, warmup, serve/mcp, fetch/search/crawl, or installs local plugins.

Impact

Expected local configuration/cache changes and outbound web/bootstrap requests when invoked; no evidence of credential harvesting, install-time execution, or covert exfiltration.

Mechanism

package-aligned CLI, MCP server, web fetching, local bootstrap, and user config writes

Rationale

The risky primitives are tied to documented, user-invoked web intelligence/MCP setup functionality, and I found no lifecycle hook, import-time payload, covert credential collection, destructive behavior, or exfiltration endpoint. Dynamic imports and command execution are bounded to local plugins, Playwright/SearXNG/bootstrap, Docker, and agent config setup workflows.

Evidence

package.jsondist/index.jsdist/cli/setup-mcp.jsdist/cli/tui/config-writer.jsdist/cli/warmup.jsdist/searxng/bootstrap.jsdist/searxng/docker.jsdist/watch/ssrf.jsdist/plugins/loader.jsdist/extraction/site-extractors/amazon.jsdist/cli/doctor.js~/.wigolo/config.json~/.wigolo/searxng~/.wigolo/state.json~/.wigolo/bootstrap.lock~/.wigolo/searxng.lockagent MCP config paths selected by setup

Network endpoints2

github.com/searxng/searxng/archive/refs/heads/master.tar.gz127.0.0.1:<searxngPort>/healthz

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with medium false-positive risk.

Evidence for block

CLI commands can modify user agent MCP configs when explicitly run: dist/cli/setup-mcp.js -> dist/cli/tui/config-writer.js.
Runtime warmup downloads Playwright browsers/ML models and bootstraps SearXNG from GitHub on user command: dist/cli/warmup.js, dist/searxng/bootstrap.js.
Plugin loader dynamically imports user-installed plugins from configured pluginsDir: dist/plugins/loader.js.
SearXNG Docker mode runs docker commands for local container management: dist/searxng/docker.js.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; entrypoint only dispatches CLI commands.
Config writes are user-invoked setup/init behavior for MCP integration, not install-time or import-time mutation.
Network use is package-aligned web search/fetch/crawl and local SearXNG/bootstrap functionality; no hardcoded exfiltration endpoint found.
dist/watch/ssrf.js blocks localhost/private IPv4/IPv6 and metadata hostnames including metadata.google.internal and 169.254/16.
dist/extraction/site-extractors/amazon.js is an Amazon product-page parser; inspected code shows parsing logic, not hidden execution or exfiltration.
Doctor masks API keys when reporting env/key-store status rather than printing full secrets.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 366 file(s), 1.27 MB of source, external domains: 127.0.0.1, api.github.com, api.search.brave.com, api.semanticscholar.org, api.stackexchange.com, api2.marginalia-search.com, cdn.jsdelivr.net, devdocs.io, developer.mozilla.org, duckduckgo.com, example.com, export.arxiv.org, github.com, hn.algolia.com, lite.duckduckgo.com, lobste.rs, news.ycombinator.com, python.org, twitter.com, www.bing.com, www.example.com, www.google.com, www.mojeek.com

Source & flagged code

7 flagged

dist/searxng/docker.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

3import { createLogger } from "../logger.js";

4const log = createLogger("searxng");

5const CONTAINER_NAME = "wigolo-searxng";

6const IMAGE = "searxng/searxng:latest";

7function isContainerRunning(name) {

8 try {

9 const result = execSync(

10 `docker inspect --format '{{.State.Running}}' -- ${shellEscape(name)}`,

11 { stdio: "pipe", encoding: "utf-8" }

12 ).trim();

13 return result === "true";

14 } catch {

15 return false;

16 }

17}

18function stopContainer(name) {

19 try {

20 const escaped = shellEscape(name);

21 execSync(`docker stop -- ${escaped} && docker rm -- ${escaped}`, { stdio: "pipe" });

dist/plugins/loader.jsView file

Lines 64-104javascript

64 }

65 continue;

66 }

67 if (!pkgJson.main) {

68 result.errors.push({

69 pluginName,

70 message: `plugin ${pluginName} has no main field in package.json`

71 });

72 continue;

dist/search/evidence.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

3import { countTokens, truncateByTokens } from "./tokens.js";

4import { applyOutputBudget } from "./truncate.js";

dist/watch/ssrf.jsView file

Lines 1-21javascript

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);

2const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([

3 "localhost",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.js

dist/extraction/site-extractors/amazon.jsView file

Lines 229-269javascript

229}

230function parseOverviewSpecifications(document) {

231 const out = /* @__PURE__ */ Object.create(null);

232 const rows = document.querySelectorAll("#productOverview_feature_div table tr");

dist/cli/doctor.jsView file

Lines 41-81javascript

41 return [

42 ` provider: ${provider} (key in ${location})`,

43 ` key (masked): ${masked}`

44 ];

45}

46function checkPython() {

47 const python = resolvePythonExe

Source & flagged code

7 flagged · loading source

dist/searxng/docker.jsView file

1import { execSync } from "node:child_process"; L2: import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

dist/plugins/loader.jsView file

84const fileUrl = pathToFileURL(entryPath).href; L85: mod = await import(fileUrl); L86: } catch (err) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/loader.jsView on unpkg · L84

dist/search/evidence.jsView file

1import { createHash } from "node:crypto"; L2: import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

dist/watch/ssrf.jsView file

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]); L2: const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([ L3: "localhost", ... L69: reason: `${fieldLabel} is not a valid URL`, L70: hint: 'Pass a fully qualified http(s) URL (e.g. "https://example.com/path").' L71: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.jsView on unpkg · L1

dist/extraction/site-extractors/amazon.jsView file

249contains invisible/control Unicode U+200D (zero width joiner) const cleaned = raw.replace(/[<U+200D><U+200E><U+200F><U+200B>]/g, "").trim();

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/extraction/site-extractors/amazon.jsView on unpkg · L249

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/cli/mcp.js -> dist/server.js -> dist/extraction/pipeline.js -> dist/extraction/v1/site-extractors.js -> dist/extraction/site-extractors/amazon.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/extraction/site-extractors/amazon.jsView on unpkg

dist/cli/doctor.jsView file

61try { L62: const r = spawnSync("npx", ["playwright", "--version"], { encoding: "utf-8", timeout: 5e3 }); L63: if (r.status === 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/doctor.jsView on unpkg · L61

Findings

2 Critical4 High4 Medium6 Low

CriticalTrojan Source Unicodedist/extraction/site-extractors/amazon.js

CriticalTrigger Reachable Dangerous Capabilitydist/extraction/site-extractors/amazon.js

HighChild Processdist/searxng/docker.js

HighShell

HighCloud Metadata Accessdist/watch/ssrf.js

HighRuntime Package Installdist/cli/doctor.js

MediumDynamic Requiredist/plugins/loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/search/evidence.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

90%Pass

Verdict confidence

IntentBenign

False-positive riskMedium

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTowhid Khan

Maintainersknockoutez

Version0.1.43-beta.2

PublishedJul 1, 2026

LicenseAGPL-3.0-only

Dependencies29

Integrityverified

Package size1.46 MB

Files1,485

Keywordsmcpmcp-serverweb-searchweb-scrapingai-agentlocal-firstcontent-extractionsearch

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/types.d.tsexports mapbin → wigolo

Runtimenode >=20

Artifact4.82 MB · 1,485 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: bench:agent, bench:embedding, bench:embedding:quality, bench:extraction +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsCopyleftLicense

Source & flagged code

7 flagged

dist/searxng/docker.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { getConfig } from "../config.js";

High

Child Process

Package source references child process execution.

dist/searxng/docker.jsView on unpkg · L1

3import { createLogger } from "../logger.js";

4const log = createLogger("searxng");

5const CONTAINER_NAME = "wigolo-searxng";

6const IMAGE = "searxng/searxng:latest";

7function isContainerRunning(name) {

8 try {

9 const result = execSync(

10 `docker inspect --format '{{.State.Running}}' -- ${shellEscape(name)}`,

11 { stdio: "pipe", encoding: "utf-8" }

12 ).trim();

13 return result === "true";

14 } catch {

15 return false;

16 }

17}

18function stopContainer(name) {

19 try {

20 const escaped = shellEscape(name);

21 execSync(`docker stop -- ${escaped} && docker rm -- ${escaped}`, { stdio: "pipe" });

dist/plugins/loader.jsView file

Lines 64-104javascript

64 }

65 continue;

66 }

67 if (!pkgJson.main) {

68 result.errors.push({

69 pluginName,

70 message: `plugin ${pluginName} has no main field in package.json`

71 });

72 continue;

dist/search/evidence.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { extractHighlights } from "./highlights.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/search/evidence.jsView on unpkg · L1

3import { countTokens, truncateByTokens } from "./tokens.js";

4import { applyOutputBudget } from "./truncate.js";

dist/watch/ssrf.jsView file

Lines 1-21javascript

1const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);

2const PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set([

3 "localhost",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch/ssrf.js

dist/extraction/site-extractors/amazon.jsView file

Lines 229-269javascript

229}

230function parseOverviewSpecifications(document) {

231 const out = /* @__PURE__ */ Object.create(null);

232 const rows = document.querySelectorAll("#productOverview_feature_div table tr");

dist/cli/doctor.jsView file

Lines 41-81javascript

41 return [

42 ` provider: ${provider} (key in ${location})`,

43 ` key (masked): ${masked}`

44 ];

45}

46function checkPython() {

47 const python = resolvePythonExe