npm JavaScript analyzed 0.2.1

@shiplightai/mcp

v0.2.1

Shiplight MCP server for AI-powered test automation

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.2.1 · analyzer v33 · 4w ago

dynamic code execution new Function() package/dist/index.js :4112 =await e.evaluate(({code:m,argsObj:v})=>new Function("return "+m)()(v),{code:this.jsCode,argsObj:w})}let p=Object.entries(c.map).filter(([,w])=>w.tagName==="iframe");u.debug(`\u{1F50D} [ext-iframe] To
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose package/dist/index.js :4987 wJWX9qZqyRka5Lann5ATsg3LL4uyU63qin",Lf="https://us.i.posthog.com",Df=process.env.SHIPLIGHT_TELEMETRY==="0"||process.env.DO_NOT_TRACK==="1",Ka=null,Zu=!1});var nh={};Ve(nh,{startServer:()=>Kf});import{

code evidence v0.2.1 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 4

net package/chrome-extension/background.js :125 await fetch(`${httpBase}/`, { method: 'HEAD', signal: AbortSignal.timeout(2000) })
net package/dist/index.js :4179 async function Qo(e){return(await(await fetch(`http:

show 27 more