MCP Observatory
5m ago Tracked 59,479 Last 5m ago 24h 2,575
github TypeScript analyzed c90267f

u8array/ZPLab

github

Visual ZPL label designer for ZPL-compatible printers. Design, import, and export labels in your browser or as a local desktop app.

maintainer
u8array
licence
MIT
first seen
2026-07-24
last seen
2026-09-16
releases · 30d
2
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in u8array/ZPLab
capabilities 10 tools
transport stdio · streamable-http · http counts 10 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • create_draft
  • export_zpl
  • get_current_design
  • get_schema
  • import_zpl
  • open_in_app
  • patch_design
  • raster_image
  • validate_draft
  • validate_zpl
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit c90267f · analyzer v33 · 16h ago

danger signals1

code evidence vv0.5.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 860

filesystem 30

  • fs (weak) u8array-ZPLab-c90267f/packages/mcp-server/scripts/build-sea.mjs :5 import { chmodSync, copyFileSync, mkdirSync, writeFileSync } from "node:fs";
  • fs (weak) u8array-ZPLab-c90267f/packages/mcp-server/src/importContract.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs u8array-ZPLab-c90267f/scratch-labelary/compare2.mjs :1 import { readFileSync } from 'node:fs';
  • fs u8array-ZPLab-c90267f/scratch-labelary/compare3.mjs :1 import { readFileSync } from 'node:fs';
  • fs (weak) u8array-ZPLab-c90267f/scripts/catalog.mjs :4 import { readFileSync } from 'node:fs';
  • fs (weak) u8array-ZPLab-c90267f/scripts/gen-attribution.mjs :14 import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
  • fs (weak) u8array-ZPLab-c90267f/scripts/gen-coverage.mjs :7 import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
  • fs (weak) u8array-ZPLab-c90267f/scripts/gen-gs1-catalog.mjs :3 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) u8array-ZPLab-c90267f/src/components/Canvas/bwipHelpers.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) u8array-ZPLab-c90267f/src/hooks/useColorScheme.test.ts :1 import { readFileSync } from 'node:fs';
  • fs (weak) u8array-ZPLab-c90267f/src/lib/zplParser.zebradesigner.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) u8array-ZPLab-c90267f/src/registry/registry-isolation.test.ts :1 import { existsSync, readdirSync, readFileSync } from "node:fs";
show 18 more
  • fs (weak) u8array-ZPLab-c90267f/src/store/pageLabelSeam.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) u8array-ZPLab-c90267f/src/test/desktopCsp.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) u8array-ZPLab-c90267f/src/test/deviceFontBoxMatch.test.ts :2 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/src/test/fixtureIdContract.test.ts :2 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/src/test/font0PlacementMatch.test.ts :2 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/src/test/labelarySync.test.ts :2 import * as fs from "fs";
  • fs (weak) u8array-ZPLab-c90267f/src/test/shapeRegression.test.ts :2 import * as fs from "fs";
  • fs (weak) u8array-ZPLab-c90267f/src/test/textBoxMatch.test.ts :2 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/src/test/textVisualRegression.test.ts :2 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/src/test/visualRegression.test.ts :2 import * as fs from "fs";
  • fs (weak) u8array-ZPLab-c90267f/tests/lib/printLabFont.ts :1 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_default_text_fixtures.ts :12 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_fixtures.ts :1 import * as fs from "fs";
  • fs (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_shape_fixtures.ts :1 import * as fs from "fs";
  • fs (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_text_fixtures.ts :25 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/tests/scripts/measure_bbox.ts :3 import * as fs from "fs";
  • fs (weak) u8array-ZPLab-c90267f/tests/scripts/report_font0_glyph_drift.ts :12 import * as fs from 'fs';
  • fs (weak) u8array-ZPLab-c90267f/vite.config.ts :1 import { readFileSync } from 'node:fs'

shell / exec 3

  • shell (weak) u8array-ZPLab-c90267f/packages/mcp-server/scripts/build-sea.mjs :4 import { execFileSync } from "node:child_process";
  • shell (weak) u8array-ZPLab-c90267f/packages/mcp-server/scripts/smoke-sea.mjs :4 import { spawn } from "node:child_process";
  • shell (weak) u8array-ZPLab-c90267f/scripts/lib/pnpm-licenses.mjs :6 import { execSync } from 'node:child_process';

network 14

  • net (weak) u8array-ZPLab-c90267f/packages/mcp-server/scripts/smoke-sea.mjs :19 fetch(BASE, {
  • net (weak) u8array-ZPLab-c90267f/packages/mcp-server/src/http.test.ts :34 return fetch(`http://127.0.0.1:${server.port}/`, {
  • net u8array-ZPLab-c90267f/packages/mcp-server/src/http.ts :1 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
  • net (weak) u8array-ZPLab-c90267f/src/components/Variables/ConnectDataWizard.server.test.tsx :126 view.unmount(); // close supersedes the fetch (token bump)
  • net u8array-ZPLab-c90267f/src/components/Variables/ServerDbStep.tsx :14 /** Runs the actual fetch (the wizard marks a success as its own load);
  • net u8array-ZPLab-c90267f/src/hooks/useSqliteConnectActions.ts :103 // Supersede any in-flight fetch (parity with the excel cancel), then drop the
  • net u8array-ZPLab-c90267f/src/lib/labelary.ts :101 res = await fetch(url, {
  • net u8array-ZPLab-c90267f/src/lib/zebraPrint.ts :17 return await fetch(`${BROWSER_PRINT_HTTP}${path}`, init);
  • net u8array-ZPLab-c90267f/src/store/datasetActions.ts :27 /** Apply an already-tabular fetch (db, excel) to the store: dataset plus mapping
  • net u8array-ZPLab-c90267f/src/store/slices/uiSlice.ts :199 /** Single orchestration point for locale loading: fetch (cached) chunk,
  • net (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_default_text_fixtures.ts :26 const res = await fetch(RENDER_URL, {
  • net (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_fixtures.ts :22 const response = await fetch(url, {
show 2 more
  • net (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_shape_fixtures.ts :15 const response = await fetch(url, {
  • net (weak) u8array-ZPLab-c90267f/tests/scripts/fetch_labelary_text_fixtures.ts :40 const res = await fetch(FONT_UPLOAD_URL, { method: 'POST', body: form });

tool registrations 10

  • create_draft u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :86
  • validate_draft u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :102
  • patch_design u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :114
  • export_zpl u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :133
  • validate_zpl u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :145
  • import_zpl u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :160
  • get_schema u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :176
  • open_in_app u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :190
  • raster_image u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :226
  • get_current_design u8array-ZPLab-c90267f/packages/mcp-server/src/server.ts :248

declared dependencies 79

  • @codemirror/commands@^6.11.0
  • @codemirror/language@^6.12.4
  • @codemirror/lint@^6.9.7
  • @codemirror/state@^6.7.4
  • @codemirror/view@^6.43.11
  • @dnd-kit/core@^6.3.1
  • @dnd-kit/sortable@^10.0.0
  • @fontsource/ibm-plex-mono@^5.3.0
  • @fontsource/ibm-plex-sans@^5.3.0
  • @headlessui/react@^2.2.10
  • @heroicons/react@^2.2.0
  • @lezer/common@^1.5.2
show 28 more
  • @lezer/highlight@^1.2.3
  • @tauri-apps/api@^2.11.1
  • @tauri-apps/plugin-dialog@^2.7.3
  • @tauri-apps/plugin-fs@^2.5.2
  • @tauri-apps/plugin-opener@^2.5.5
  • @tauri-apps/plugin-process@^2.3.1
  • @tauri-apps/plugin-updater@^2.11.0
  • @zplab/core@workspace:*
  • bwip-js@^4.11.4
  • fflate@^0.8.3
  • konva@^10.3.3
  • papaparse@^5.7.0
  • react@^19.2.8
  • react-dom@^19.2.8
  • react-konva@^19.2.6
  • zod@^4.5.4
  • zundo@^2.3.0
  • zustand@^5.0.15
  • @babel/core@^8.0.1
  • @eslint/js@^10.0.1
  • @napi-rs/canvas@^1.0.8
  • @playwright/test@^1.63.0
  • @rolldown/plugin-babel@^0.2.3
  • @tailwindcss/vite@^4.3.3
  • @tauri-apps/cli@^2.11.4
  • @testing-library/dom@^10.4.1
  • @testing-library/react@^16.3.3
  • @testing-library/user-event@^14.6.7

39 more not shown — this panel samples each group; the count above is the real total.