io.github.Cipher208/ariel-memory

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• bin.js:13mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    for (const cmd of candidates) {
      try {
        const out = execSync(`"${cmd}" --version 2>&1`, { encoding: 'utf8', shell: true });
        const match = out.match(/Python (\d+\.\d+)/);
        if (match) {

• bin.js:13mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    for (const cmd of candidates) {
      try {
        const out = execSync(`"${cmd}" --version 2>&1`, { encoding: 'utf8', shell: true });
        const match = out.match(/Python (\d+\.\d+)/);
        if (match) {

• bin.js:18mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

          const version = parseFloat(match[1]);
          if (version >= 3.10) {
            const pathOut = execSync(`"${cmd}" -c "import sys; print(sys.executable)" 2>&1`, { encoding: 'utf8', shell: true });
            if (pathOut.includes('hermes') || pathOut.includes('venv') || pathOut.includes('.local') || pathOut.includes('conda')) {
              continue;

• bin.js:18mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

          const version = parseFloat(match[1]);
          if (version >= 3.10) {
            const pathOut = execSync(`"${cmd}" -c "import sys; print(sys.executable)" 2>&1`, { encoding: 'utf8', shell: true });
            if (pathOut.includes('hermes') || pathOut.includes('venv') || pathOut.includes('.local') || pathOut.includes('conda')) {
              continue;

• bin.js:38mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      if (!p) continue;
      try {
        const out = execSync(`"${p}" --version 2>&1`, { encoding: 'utf8' });
        if (out.includes('Python 3.')) {
          return `"${p}"`;

• bin.js:38mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      if (!p) continue;
      try {
        const out = execSync(`"${p}" --version 2>&1`, { encoding: 'utf8' });
        if (out.includes('Python 3.')) {
          return `"${p}"`;

• install.js:22mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    for (const cmd of candidates) {
      try {
        const out = execSync(`"${cmd}" --version 2>&1`, { encoding: 'utf8', shell: true });
        const match = out.match(/Python (\d+\.\d+)/);
        if (match) {

• install.js:22mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    for (const cmd of candidates) {
      try {
        const out = execSync(`"${cmd}" --version 2>&1`, { encoding: 'utf8', shell: true });
        const match = out.match(/Python (\d+\.\d+)/);
        if (match) {

• install.js:28mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

          if (version >= 3.10) {
            // Check if it's a venv
            const pathOut = execSync(`"${cmd}" -c "import sys; print(sys.executable)" 2>&1`, { encoding: 'utf8', shell: true });
            if (pathOut.includes('hermes') || pathOut.includes('venv') || pathOut.includes('.local') || pathOut.includes('conda')) {
              continue;

• install.js:28mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

          if (version >= 3.10) {
            // Check if it's a venv
            const pathOut = execSync(`"${cmd}" -c "import sys; print(sys.executable)" 2>&1`, { encoding: 'utf8', shell: true });
            if (pathOut.includes('hermes') || pathOut.includes('venv') || pathOut.includes('.local') || pathOut.includes('conda')) {
              continue;

• install.js:50mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      if (!p) continue;
      try {
        const out = execSync(`"${p}" --version 2>&1`, { encoding: 'utf8' });
        if (out.includes('Python 3.')) {
          return `"${p}"`;

• install.js:50mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      if (!p) continue;
      try {
        const out = execSync(`"${p}" --version 2>&1`, { encoding: 'utf8' });
        if (out.includes('Python 3.')) {
          return `"${p}"`;

• install.js:62mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

  function isInstalled(python) {
    try {
      const out = execSync(`${python} -m pip show ${PACKAGE_NAME}`, { encoding: 'utf8' });
      const versionMatch = out.match(/Version:\s*(.+)/);
      if (versionMatch) {

• install.js:62mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

  function isInstalled(python) {
    try {
      const out = execSync(`${python} -m pip show ${PACKAGE_NAME}`, { encoding: 'utf8' });
      const versionMatch = out.match(/Version:\s*(.+)/);
      if (versionMatch) {

• install.js:77mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    try {
      // Try PyPI first
      execSync(`${python} -m pip install --user "${PACKAGE_NAME}>=${MIN_VERSION}" 2>&1`, {
        stdio: 'inherit',
      });

• install.js:77mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    try {
      // Try PyPI first
      execSync(`${python} -m pip install --user "${PACKAGE_NAME}>=${MIN_VERSION}" 2>&1`, {
        stdio: 'inherit',
      });

• install.js:85mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      console.log(`[mcp-ariel-memory] PyPI install failed, installing from GitHub...`);
      try {
        execSync(`${python} -m pip install --user "git+https://github.com/Cipher208/mcp-ariel-memory.git@master"`, {
          stdio: 'inherit',
        });

• install.js:85mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      console.log(`[mcp-ariel-memory] PyPI install failed, installing from GitHub...`);
      try {
        execSync(`${python} -m pip install --user "git+https://github.com/Cipher208/mcp-ariel-memory.git@master"`, {
          stdio: 'inherit',
        });

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (1 issue(s) in the last 6 months, under `03` §5's floor of 3): 1.0 day(s) to first maintainer comment

• release_cadence

  released 3 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  package.json declares 'MIT' but no LICENSE file ships with the source

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately