npm JavaScript analyzed 3.15.2

@mcpjam/cli

v3.15.2

Test, debug, and validate MCP servers — health checks, OAuth conformance, tool-surface diffing, and structured triage from the terminal or CI

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.15.2 · analyzer v28 · 2d ago

suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose package/dist/index.js :7784 var POSTHOG_HOST = "https://us.i.posthog.com";

code evidence v3.15.2 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1

fs package/dist/index.js :3 import { realpathSync, mkdirSync, writeFileSync, readFileSync, existsSync, statSync, closeSync, renameSync, openSync } from 'fs';