npm JavaScript analyzed 1.10.0 unconfirmed MCP

@shogo-ai/sdk

v1.10.0

npm

Shogo Platform SDK - Zero-boilerplate auth and database for Shogo apps

Drift inferred · capture-to-capture

HIGH 2026-06-06 code analysis flagged hidden prompt content in @shogo-ai/sdk
HIGH 2026-06-04 code analysis flagged dynamic code execution ×3 in @shogo-ai/sdk

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

code evidence v1.10.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 173

fs package/bin/cli.mjs :12 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
fs package/dist/chunk-QGJ2C72D.js :122 await fs.rm(stagingDir, { recursive: true, force: true });
fs package/dist/generators/index.cjs :4243 var import_fs = require("fs");
fs package/dist/generators/index.js :4147 import { existsSync, writeFileSync } from "fs";
fs package/dist/index.cjs :1488 await fs.rm(stagingDir, { recursive: true, force: true });
fs package/dist/memory/index.cjs :34 var import_node_fs = require("fs");
fs package/dist/memory/index.js :2 import { existsSync, readFileSync, readdirSync, statSync } from "fs";
fs package/dist/projects/cloud-file-transport.cjs :146 await fs.rm(stagingDir, { recursive: true, force: true });

shell package/bin/cli.mjs :14 import { execSync, execFileSync } from 'child_process'

net package/dist/agent/index.cjs :403 fetch();
net package/dist/agent/index.js :372 fetch();
net package/dist/generators/index.cjs :2095 lines.push(" const response = await fetch(url, {");
net package/dist/generators/index.js :1999 lines.push(" const response = await fetch(url, {");
net package/dist/index.cjs :287 const response = await fetch(url, {
net package/dist/index.js :245 const response = await fetch(url, {

secrets package/bin/cli.mjs :92 const shogoApiKey = process.env.SHOGO_API_KEY
secrets package/dist/tools/index.cjs :107 const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
secrets package/dist/tools/index.js :78 const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
secrets package/dist/tools/server.cjs :42 const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
secrets package/dist/tools/server.js :18 const runtimeToken = process.env.RUNTIME_AUTH_SECRET;

show 23 more