ai.paperlantern/code

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/auth.ts:17mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    const platform = process.platform;
    try {
      if (platform === "darwin") execSync(`open "${url}"`);
      else if (platform === "win32") execSync(`start "" "${url}"`);
      else execSync(`xdg-open "${url}"`);

• src/auth.ts:17mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    const platform = process.platform;
    try {
      if (platform === "darwin") execSync(`open "${url}"`);
      else if (platform === "win32") execSync(`start "" "${url}"`);
      else execSync(`xdg-open "${url}"`);

• src/auth.ts:18mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    try {
      if (platform === "darwin") execSync(`open "${url}"`);
      else if (platform === "win32") execSync(`start "" "${url}"`);
      else execSync(`xdg-open "${url}"`);
    } catch {

• src/auth.ts:18mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    try {
      if (platform === "darwin") execSync(`open "${url}"`);
      else if (platform === "win32") execSync(`start "" "${url}"`);
      else execSync(`xdg-open "${url}"`);
    } catch {

• src/auth.ts:19mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      if (platform === "darwin") execSync(`open "${url}"`);
      else if (platform === "win32") execSync(`start "" "${url}"`);
      else execSync(`xdg-open "${url}"`);
    } catch {
      // browser open failed — user will use the printed URL

• src/auth.ts:19mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      if (platform === "darwin") execSync(`open "${url}"`);
      else if (platform === "win32") execSync(`start "" "${url}"`);
      else execSync(`xdg-open "${url}"`);
    } catch {
      // browser open failed — user will use the printed URL

• src/auth.ts:53mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  export async function authenticate(): Promise<string> {
    // Step 1: Request a device code
    const codeResp = await fetch(DEVICE_CODE_URL, {
      method: "POST",
      headers: { "Content-Type": "application/json" },

• src/auth.ts:86mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      let resp: Response;
      try {
        resp = await fetch(DEVICE_TOKEN_URL, {
          method: "POST",
          headers: { "Content-Type": "application/json" },

Auth Posture

• authentication_model

  no authentication appears in the source we fetched, but this server's network endpoint is a hosted remote, whose authentication can be enforced in front of its code — and no credential header is declared. An undeclared header is not an absent one, so `03` §4's "no authentication" band is not established.

• transport_security

  declared endpoint(s) are HTTPS: https://mcp.paperlantern.ai/chat/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

• package-lock.jsonesbuild 0.27.7 — GHSA-g7r4-m6w7-qqqr

  transitive, CVSS 2.5, fixed in 0.28.1

  https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr

Maintenance

• recency

  last commit 178 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  this repository publishes neither releases nor version tags

• bus_factor

  sole maintainer, and no commit in over 90 days

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately