npm JavaScript analyzed 16.3.0 unconfirmed MCP

ccjk

v16.3.0

npm

Clavue / Claude Code / Codex / Grok CLI 统一配置工具（ccjk 交互与配置方法）

Drift inferred · capture-to-capture

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v16.3.0 · analyzer v33 · 1w ago

credential in logs credential in log package/dist/chunks/simple-config.mjs :2975 console.log(ansis.bold.green(` \u2022 ${i18n.t("ccr:ccrUiApiKey") || "CCR UI API Key"}: ${apiKey}`));

code evidence v16.3.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 20

fs package/dist/chunks/codex-runtime.mjs :1 import { readdirSync } from 'node:fs';
fs package/dist/chunks/simple-config.mjs :1 import * as nodeFs from 'node:fs';
fs package/dist/cli.mjs :5 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';

shell package/dist/chunks/commands.mjs :1 import { exec } from 'node:child_process';
shell package/dist/chunks/simple-config.mjs :6 import { exec as exec$1 } from 'node:child_process';
shell package/dist/cli.mjs :13 import { execSync, spawnSync } from 'node:child_process';

net package/dist/chunks/simple-config.mjs :2645 const response = await fetch(PROVIDER_PRESETS_URL, {
net package/dist/cli.mjs :856 const res = await fetch(url, { method: "POST", headers, body, signal: AbortSignal.timeout(TIMEOUT_MS) });

secrets package/dist/cli.mjs :2395 const hasDeepSeekKey = Boolean(process.env.DEEPSEEK_API_KEY?.trim());