github TypeScript re-analysis due

lingion/plot-mcp-worker

github

Cloudflare Worker MCP server — 函数绘图、力分析、电路图、3D几何、Venn图等STEM可视化工具

maintainer: lingion
license: NOASSERTION
first seen: 2026-06-28
last seen: 2026-08-31
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 27 tools

transport http counts 27 tools · 0 res · 0 prompts permission surface via code analysis

tools

analysis
c_memory_diagram_link
circuit_diagram_link
circuit_template_link
diagram
force_analysis_link
force_analysis_template_link
force_diagram_link
geometry_3d
health
multi_plot
plot
plot_bar_json
plot_json
plot_multi
plot_multi_json
plot_multi_png_link
plot_png_link
plot_series
plot_series_json
plot_series_png_link
shape3d_link
teaching
teaching_sequence_link
teaching_template_link
template
venn_diagram_link

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 37f1550 · analyzer v33 · 1w ago

danger signals1

dynamic code execution new Function() lingion-plot-mcp-worker-37f1550/src/index.js :539 var f = new Function(param, "with(this.functions) with (this.ternaryOps) with (this.binaryOps) with (this.unaryOps) { return " + expressionToString(this.simplify(variables).tokens, true) + "; }");

code evidence vv0.4.14 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 22

filesystem 5

fs (weak) lingion-plot-mcp-worker-37f1550/scripts/deploy-bundle-fingerprint.mjs :1 import { mkdtemp, readFile, rm } from "node:fs/promises";
fs (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-compact-diagnose.mjs :1 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-drift-check.mjs :1 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-struct-diff.mjs :1 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) lingion-plot-mcp-worker-37f1550/scripts/local-force-analysis-probe.mjs :1 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";

shell / exec 4

shell (weak) lingion-plot-mcp-worker-37f1550/scripts/deploy-and-verify.mjs :1 import { execFile } from "node:child_process";
shell (weak) lingion-plot-mcp-worker-37f1550/scripts/deploy-bundle-fingerprint.mjs :4 import { execFile } from "node:child_process";
shell (weak) lingion-plot-mcp-worker-37f1550/scripts/deploy-preflight.mjs :1 import { execFile } from "node:child_process";
shell (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-verify.mjs :1 import { execFile } from "node:child_process";

network 7

net (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-compact-diagnose.mjs :59 const response = await fetch(endpoint, {
net (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-drift-check.mjs :87 const response = await fetch(endpoint, {
net (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-struct-diff.mjs :59 const response = await fetch(endpoint, {
net (weak) lingion-plot-mcp-worker-37f1550/scripts/remote-health.mjs :5 const response = await fetch(endpoint, {
net (weak) lingion-plot-mcp-worker-37f1550/scripts/smoke.mjs :12 const resp = await fetch(`${BASE}/mcp`, { method: "POST", headers: { "Content-Type": "application/json" }, body });
net lingion-plot-mcp-worker-37f1550/src/index.js :4216 input = fetch(input);
net lingion-plot-mcp-worker-37f1550/src/index.ts :3290 async fetch(req: Request, env: Env): Promise<Response> {

tool registrations 49

health lingion-plot-mcp-worker-37f1550/src/index.js :4745
plot lingion-plot-mcp-worker-37f1550/src/index.js :4750
plot_json lingion-plot-mcp-worker-37f1550/src/index.js :4759
plot_png_link lingion-plot-mcp-worker-37f1550/src/index.js :4768
plot_multi lingion-plot-mcp-worker-37f1550/src/index.js :4777
plot_multi_json lingion-plot-mcp-worker-37f1550/src/index.js :4787
plot_multi_png_link lingion-plot-mcp-worker-37f1550/src/index.js :4797
plot_series lingion-plot-mcp-worker-37f1550/src/index.js :4807
plot_series_json lingion-plot-mcp-worker-37f1550/src/index.js :4817
plot_series_png_link lingion-plot-mcp-worker-37f1550/src/index.js :4827
force_diagram_link lingion-plot-mcp-worker-37f1550/src/index.js :4837
force_analysis_link lingion-plot-mcp-worker-37f1550/src/index.js :4847
circuit_diagram_link lingion-plot-mcp-worker-37f1550/src/index.js :4866
force_analysis_template_link lingion-plot-mcp-worker-37f1550/src/index.js :4885
circuit_template_link lingion-plot-mcp-worker-37f1550/src/index.js :4908
venn_diagram_link lingion-plot-mcp-worker-37f1550/src/index.js :4926
c_memory_diagram_link lingion-plot-mcp-worker-37f1550/src/index.js :4939
shape3d_link lingion-plot-mcp-worker-37f1550/src/index.js :4952
plot_bar_json lingion-plot-mcp-worker-37f1550/src/index.js :4957
teaching_template_link lingion-plot-mcp-worker-37f1550/src/index.js :4967
teaching_sequence_link lingion-plot-mcp-worker-37f1550/src/index.js :4977
health lingion-plot-mcp-worker-37f1550/src/index.ts :342
plot lingion-plot-mcp-worker-37f1550/src/index.ts :347
plot_json lingion-plot-mcp-worker-37f1550/src/index.ts :356
plot_png_link lingion-plot-mcp-worker-37f1550/src/index.ts :365
plot_multi lingion-plot-mcp-worker-37f1550/src/index.ts :374
plot_multi_json lingion-plot-mcp-worker-37f1550/src/index.ts :383
plot_multi_png_link lingion-plot-mcp-worker-37f1550/src/index.ts :392
multi_plot lingion-plot-mcp-worker-37f1550/src/index.ts :401
plot_series lingion-plot-mcp-worker-37f1550/src/index.ts :434
plot_series_json lingion-plot-mcp-worker-37f1550/src/index.ts :443
plot_series_png_link lingion-plot-mcp-worker-37f1550/src/index.ts :452
force_diagram_link lingion-plot-mcp-worker-37f1550/src/index.ts :461
force_analysis_link lingion-plot-mcp-worker-37f1550/src/index.ts :470
circuit_diagram_link lingion-plot-mcp-worker-37f1550/src/index.ts :488
force_analysis_template_link lingion-plot-mcp-worker-37f1550/src/index.ts :507
circuit_template_link lingion-plot-mcp-worker-37f1550/src/index.ts :530
venn_diagram_link lingion-plot-mcp-worker-37f1550/src/index.ts :548
c_memory_diagram_link lingion-plot-mcp-worker-37f1550/src/index.ts :561
shape3d_link lingion-plot-mcp-worker-37f1550/src/index.ts :574
plot_bar_json lingion-plot-mcp-worker-37f1550/src/index.ts :578
teaching_template_link lingion-plot-mcp-worker-37f1550/src/index.ts :587
teaching_sequence_link lingion-plot-mcp-worker-37f1550/src/index.ts :597
plot_series lingion-plot-mcp-worker-37f1550/src/index.ts :609
diagram lingion-plot-mcp-worker-37f1550/src/index.ts :629
geometry_3d lingion-plot-mcp-worker-37f1550/src/index.ts :655
teaching lingion-plot-mcp-worker-37f1550/src/index.ts :667
template lingion-plot-mcp-worker-37f1550/src/index.ts :681
analysis lingion-plot-mcp-worker-37f1550/src/index.ts :695

declared dependencies 6

@resvg/resvg-wasm@^2.6.2
expr-eval@^2.0.2
opentype.js@^1.3.4
@cloudflare/workers-types@^4.20260418.0
typescript@^5.8.3
wrangler@^4.81.0

perm:untrusted 4

untrusted (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-compact-diagnose.mjs :153 const remoteSvg = await fetch(remoteResult.svg_url).then((response) => response.text());
untrusted (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-drift-check.mjs :115 const svg = await fetch(result.svg_url).then((response) => response.text());
untrusted (weak) lingion-plot-mcp-worker-37f1550/scripts/force-analysis-struct-diff.mjs :136 return fetch(result.svg_url).then((response) => response.text());
untrusted (weak) lingion-plot-mcp-worker-37f1550/scripts/remote-health.mjs :98 const svg = await fetch(forceResult.data.svg_url).then((response) => response.text());