github JavaScript re-analysis due

Dayananda-D/DevCDP

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 87054af · analyzer v33 · 1w ago

dynamic code execution eval() Dayananda-D-DevCDP-87054af/src/cdp/connection.js :127 async eval(expression, opts = {}) {
dynamic code execution new Function() Dayananda-D-DevCDP-87054af/test/validate.mjs :215 new Function(agentSrc); // throws on a syntax error

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 43

fs Dayananda-D-DevCDP-87054af/initialize_MCP.js :24 import fs from "fs";
fs (weak) Dayananda-D-DevCDP-87054af/plugins/devcdp/scripts/launch.mjs :13 import fs from "fs";
fs (weak) Dayananda-D-DevCDP-87054af/scripts/gen-docs.mjs :8 import fs from "fs";
fs Dayananda-D-DevCDP-87054af/src/cdp/launch.js :11 import fs from "fs";
fs Dayananda-D-DevCDP-87054af/src/cdp/registry.js :15 import fs from "fs";
fs Dayananda-D-DevCDP-87054af/src/core/config.js :28 import fs from "fs";
fs Dayananda-D-DevCDP-87054af/src/store/memory.js :18 import fs from "fs";
fs Dayananda-D-DevCDP-87054af/src/tools/capture.js :21 import fs from "fs";
fs Dayananda-D-DevCDP-87054af/src/tools/discover.js :13 import fs from "fs";
fs Dayananda-D-DevCDP-87054af/src/tools/settings.js :10 import fs from "fs";
fs (weak) Dayananda-D-DevCDP-87054af/test/installer.test.mjs :13 import fs from "fs";
fs (weak) Dayananda-D-DevCDP-87054af/test/integration.mjs :8 import fs from "fs";

show 1 more

fs (weak) Dayananda-D-DevCDP-87054af/test/validate.mjs :8 import fs from "fs";

shell Dayananda-D-DevCDP-87054af/initialize_MCP.js :28 import { execFileSync } from "child_process";
shell (weak) Dayananda-D-DevCDP-87054af/plugins/devcdp/scripts/launch.mjs :16 import { spawnSync } from "child_process";
shell (weak) Dayananda-D-DevCDP-87054af/scripts/mcp-probe.mjs :13 import { spawn } from "child_process";
shell Dayananda-D-DevCDP-87054af/src/cdp/launch.js :10 import { spawn } from "child_process";
shell (weak) Dayananda-D-DevCDP-87054af/test/installer.test.mjs :329 const { execFileSync } = await import("child_process");

net Dayananda-D-DevCDP-87054af/src/cdp/launch.js :13 import net from "net";
net Dayananda-D-DevCDP-87054af/src/debug/sourcemap.js :93 `fetch(${JSON.stringify(url)},{credentials:"include"})
net Dayananda-D-DevCDP-87054af/src/tools/discover.js :261 `fetch(${JSON.stringify(origin + p)},{credentials:"include"})
net (weak) Dayananda-D-DevCDP-87054af/test/fixture-app/server.mjs :9 import http from "http";
net (weak) Dayananda-D-DevCDP-87054af/test/integration.mjs :1333 await ctx.conn.client.Runtime.evaluate({ expression: `fetch('/api/orders')` });