github JavaScript analyzed c5d4458

scanchila/MetaWebMCP

github

Build, test, and export WebMCP tools from live website workflows.

maintainer: scanchila
licence: MIT
first seen: 2026-09-04
last seen: 2026-09-04
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit c5d4458 · analyzer v33 · 2w ago

skills & prompt files 3

danger signals10

dynamic code execution new Function() scanchila-MetaWebMCP-c5d4458/deploy/cloudflare/verify-patches.mjs :37 const evaluateAgentFactory = new Function(
dynamic code execution vm exec scanchila-MetaWebMCP-c5d4458/tests/cloudflare-browser-policy.test.mjs :257 vm.runInNewContext(browserDirectNetworkInitScript, context);
dynamic code execution vm exec scanchila-MetaWebMCP-c5d4458/tests/generator.test.mjs :57 vm.runInNewContext(executable, context);
suspicious endpoint 169.254.169.254 (cloud metadata) scanchila-MetaWebMCP-c5d4458/tests/browser-mcp-session.test.mjs :214 'http://169.254.169.254.nip.io/latest/meta-data/',
suspicious endpoint 169.254.169.254 (cloud metadata) scanchila-MetaWebMCP-c5d4458/tests/cloudflare-browser-policy.test.mjs :81 'http://169.254.169.254/latest/meta-data/',
suspicious endpoint 8.8.8.8 scanchila-MetaWebMCP-c5d4458/tests/export-security.test.mjs :94 url: 'https://8.8.8.8/',
suspicious endpoint 169.254.169.254 (cloud metadata) scanchila-MetaWebMCP-c5d4458/tests/mcp-recipe.test.mjs :109 steps: [{ tool, arguments: { url: 'http://169.254.169.254/latest/meta-data/' } }],
suspicious endpoint 169.254.169.254 (cloud metadata) scanchila-MetaWebMCP-c5d4458/tests/security.test.mjs :55 await assert.rejects(validateTargetUrl('http://169.254.169.254.nip.io/'), /Private and local/);
suspicious endpoint 169.254.169.254 (cloud metadata) scanchila-MetaWebMCP-c5d4458/tests/server-mcp.test.mjs :204 steps: [{ tool: 'browser_navigate', arguments: { url: 'http://169.254.169.254/latest/meta-data/' } }],
suspicious endpoint 8.8.8.8 scanchila-MetaWebMCP-c5d4458/tests/server-mcp.test.mjs :375 body: JSON.stringify({ workspaceId, url: 'https://8.8.8.8/', goal: 'Find sessions.' }),

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 74

filesystem 20

fs scanchila-MetaWebMCP-c5d4458/deploy/cloudflare/patch-dependencies.mjs :1 import { readFile, writeFile } from 'node:fs/promises';
fs scanchila-MetaWebMCP-c5d4458/deploy/cloudflare/verify-patches.mjs :2 import { readFile } from 'node:fs/promises';
fs scanchila-MetaWebMCP-c5d4458/evidence/relay-sessions-webmcp.zip!/relay-sessions-webmcp/serve.mjs :2 import { readFile } from 'node:fs/promises';
fs scanchila-MetaWebMCP-c5d4458/lib/generator.mjs :829 'serve.mjs': `import http from 'node:http';\nimport { readFile } from 'node:fs/promises';\nimport path from 'node:path';\nconst root = new URL('.', import.meta.url);\nconst types = { '.html':'text/htm
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/capture-fincaraiz-benchmark.mjs :4 import { writeFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/capture-fincaraiz-metawebmcp.mjs :4 import { writeFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/capture-metrocuadrado-benchmark.mjs :4 import { writeFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/capture-steam-benchmark.mjs :4 import { writeFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/check.mjs :1 import { readdir, readFile, stat } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/score-fincaraiz-benchmark.mjs :4 import { readFile, writeFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/score-metrocuadrado-benchmark.mjs :4 import { readFile, writeFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/score-steam-benchmark.mjs :4 import { readFile, writeFile } from 'node:fs/promises';

show 8 more

fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/serve-metawebmcp-cold-benchmark.mjs :4 import { writeFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/scripts/summarize-lighthouse.mjs :2 import { readFile, writeFile } from 'node:fs/promises';
fs scanchila-MetaWebMCP-c5d4458/server.mjs :2 import { readFile, stat } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/test-artifacts/relay-sessions-webmcp.zip!/relay-sessions-webmcp/serve.mjs :2 import { readFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/tests/build-pins.test.mjs :3 import { readFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/tests/cloudflare-dependency-policy.test.mjs :3 import { readFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/tests/compose-security.test.mjs :3 import { readFile } from 'node:fs/promises';
fs (weak) scanchila-MetaWebMCP-c5d4458/tests/deployment-provenance.test.mjs :5 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';

shell / exec 6

shell scanchila-MetaWebMCP-c5d4458/deploy/cloudflare/deploy.mjs :1 import { execFileSync, spawnSync } from 'node:child_process';
shell (weak) scanchila-MetaWebMCP-c5d4458/scripts/check.mjs :3 import { spawnSync } from 'node:child_process';
shell (weak) scanchila-MetaWebMCP-c5d4458/tests/deployment-provenance.test.mjs :3 import { spawn, spawnSync } from 'node:child_process';
shell (weak) scanchila-MetaWebMCP-c5d4458/tests/egress-proxy.test.mjs :3 import { spawnSync } from 'node:child_process';
shell (weak) scanchila-MetaWebMCP-c5d4458/tests/export-security.test.mjs :3 import { spawn } from 'node:child_process';
shell (weak) scanchila-MetaWebMCP-c5d4458/tests/server-mcp.test.mjs :3 import { spawn } from 'node:child_process';

network 20

net scanchila-MetaWebMCP-c5d4458/deploy/cloudflare/export-store.mjs :23 async fetch(request) {
net scanchila-MetaWebMCP-c5d4458/deploy/cloudflare/worker.mjs :137 const response = await fetch(target, {
net scanchila-MetaWebMCP-c5d4458/egress-proxy.mjs :2 import http from 'node:http';
net scanchila-MetaWebMCP-c5d4458/evidence/relay-sessions-webmcp.zip!/relay-sessions-webmcp/serve.mjs :1 import http from 'node:http';
net scanchila-MetaWebMCP-c5d4458/lib/generator.mjs :829 'serve.mjs': `import http from 'node:http';\nimport { readFile } from 'node:fs/promises';\nimport path from 'node:path';\nconst root = new URL('.', import.meta.url);\nconst types = { '.html':'text/htm
net scanchila-MetaWebMCP-c5d4458/lib/security.mjs :2 import http from 'node:http';
net scanchila-MetaWebMCP-c5d4458/public/js/app.js :1194 fetch('/demo/index.html').then((response) => response.text()),
net scanchila-MetaWebMCP-c5d4458/public/js/browser-mcp-session.js :77 const response = await this.fetch(this.url(path), { credentials: 'same-origin', ...options });
net scanchila-MetaWebMCP-c5d4458/public/js/demo-analyzer.js :15 const response = await fetch(path, {
net scanchila-MetaWebMCP-c5d4458/public/js/mcp-http-client.js :133 const response = await this.fetch(this.endpoint, {
net (weak) scanchila-MetaWebMCP-c5d4458/scripts/capture-fincaraiz-benchmark.mjs :66 const response = await fetch(url, { headers: { 'user-agent': USER_AGENT } });
net (weak) scanchila-MetaWebMCP-c5d4458/scripts/summarize-lighthouse.mjs :18 const healthResponse = await fetch(new URL('/health', appUrl), {

show 8 more

net scanchila-MetaWebMCP-c5d4458/server.mjs :1 import http from 'node:http';
net (weak) scanchila-MetaWebMCP-c5d4458/test-artifacts/relay-sessions-webmcp.zip!/relay-sessions-webmcp/serve.mjs :1 import http from 'node:http';
net (weak) scanchila-MetaWebMCP-c5d4458/tests/deployment-provenance.test.mjs :6 import http from 'node:http';
net (weak) scanchila-MetaWebMCP-c5d4458/tests/egress-proxy.test.mjs :5 import http from 'node:http';
net (weak) scanchila-MetaWebMCP-c5d4458/tests/export-security.test.mjs :4 import http from 'node:http';
net (weak) scanchila-MetaWebMCP-c5d4458/tests/security.test.mjs :3 import http from 'node:http';
net (weak) scanchila-MetaWebMCP-c5d4458/tests/server-mcp.test.mjs :4 import http from 'node:http';
net (weak) scanchila-MetaWebMCP-c5d4458/tests/tool-authoring.test.mjs :103 executor: { type: 'javascript', source: 'fetch("https://attacker.example")' },

secrets 1

secrets scanchila-MetaWebMCP-c5d4458/server.mjs :34 const MCP_CAPABILITY_SECRET = process.env.MCP_CAPABILITY_SECRET || crypto.randomBytes(48).toString('base64url');

install hooks 1

postinstall scanchila-MetaWebMCP-c5d4458/deploy/cloudflare/package.json :7 node patch-dependencies.mjs