github JavaScript re-analysis due

DataArche/SSWorld

github

MCP server for agent-authored 3D geo scenes: write SSDL, render on a real WebGPU engine, read the frame back.

maintainer
DataArche
licence
Apache-2.0
first seen
2026-09-12
last seen
2026-09-17
releases · 30d
4
short id

DataArche/SSWorld is an MCP server distributed on github, maintained by DataArche, tracked here since September 2026. It has shipped 4 releases and exposes 12 tools. Tools include ssworld_capture_frame, ssworld_catalog, ssworld_compile, ssworld_engine_status, ssworld_environment_read, ssworld_preview, and 6 more. Its composite risk grade is A — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised 2 review prompts — dangerous code and exfiltration combo — each a pattern worth a human look rather than a finding of fault.

Its 12 tools appear to reach filesystem and network, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →
tools 12
  • ssworld_capture_frame screenshot of the open preview through the engine (saveImage2Base64); stats with luma percentiles, exposure tails, colour-class coverage ov…
  • ssworld_catalog component index / one contract / components: [...] in one call (detail: compact hoists shared members); catalog_digest + if_digest for cach…
  • ssworld_compile SSDL 0.3 compiler with real diagnostics, node_count, budget usage and logic (declared properties, states, host calls); catalog/runtime mism…
  • ssworld_engine_status engine pair installed? (install: true to download)
  • ssworld_environment_read ask the engine what it actually received for the environment: the adopted sun's direction read back from the native sun and converted to az…
  • ssworld_preview starts the local preview server, returns http://127.0.0.1:8880/projects/<name>/index.html, whether the page is open, page.clients (every br…
  • ssworld_project_create new runnable project (anchored at lon/lat/height), compiled
  • ssworld_project_list projects in ~/.ssworld/projects
  • ssworld_scene_inspect compiled-scene facts without rendering: budget ratio, subtrees by size, leaf children by type, nodes per source file, primitive extent, the…
  • ssworld_source_batch atomic multi-edit: text patches and node-level {node_id, set, unset} across files; all validated in memory before anything is written; vali…
  • ssworld_source_patch exact-span edit (old_string → new_string, uniqueness checked, replace_all opt-in) with the same digest guard
  • tool purpose
release cadence · 90d 4 releases
06-20 00:00 08-03 00:00 now
recent releases last 4
version date src
engine-7da2be035739ccf4 2026-09-17 github
engine-f9ba142770941c22 2026-09-15 github
engine-32e8d76ff2d51b21 2026-09-12 github
engine-e4c94c0e87f1de02 2026-09-10 github

view all →