io.github.lchampz/heimdall

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/tools/inspect_runtime_versions.ts:12mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      const runCommand = (cmd: string): string => {
          try {
              return execSync(cmd, { stdio: ["pipe", "pipe", "ignore"] }).toString().trim();
          } catch {
              return "not_found";

• src/tools/manage_ports.ts:41mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      try {
          
          const pidOutput = execSync(`lsof -t -i:${port}`, { stdio: ["pipe", "pipe", "ignore"] }).toString().trim();
  
          if (!pidOutput) {

• src/tools/manage_ports.ts:41mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      try {
          
          const pidOutput = execSync(`lsof -t -i:${port}`, { stdio: ["pipe", "pipe", "ignore"] }).toString().trim();
  
          if (!pidOutput) {

• src/tools/manage_ports.ts:52mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

          const pids = pidOutput.split("\n");
          for (const pid of pids) {
              execSync(`kill -9 ${pid}`);
          }
  

• src/tools/manage_ports.ts:52mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

          const pids = pidOutput.split("\n");
          for (const pid of pids) {
              execSync(`kill -9 ${pid}`);
          }
  

• src/tools/path_inspector.ts:12mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      criticalTools.forEach(tool => {
          try {
              const version = execSync(`${tool} --version`, { stdio: ["pipe", "pipe", "ignore"] }).toString().split("\n")[0];
              const location = execSync(`which ${tool}`, { stdio: ["pipe", "pipe", "ignore"] }).toString().trim();
              const isSystem = location.startsWith("/usr/bin");

• src/tools/path_inspector.ts:12mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      criticalTools.forEach(tool => {
          try {
              const version = execSync(`${tool} --version`, { stdio: ["pipe", "pipe", "ignore"] }).toString().split("\n")[0];
              const location = execSync(`which ${tool}`, { stdio: ["pipe", "pipe", "ignore"] }).toString().trim();
              const isSystem = location.startsWith("/usr/bin");

• src/tools/path_inspector.ts:13mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

          try {
              const version = execSync(`${tool} --version`, { stdio: ["pipe", "pipe", "ignore"] }).toString().split("\n")[0];
              const location = execSync(`which ${tool}`, { stdio: ["pipe", "pipe", "ignore"] }).toString().trim();
              const isSystem = location.startsWith("/usr/bin");
  

• src/tools/path_inspector.ts:13mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

          try {
              const version = execSync(`${tool} --version`, { stdio: ["pipe", "pipe", "ignore"] }).toString().split("\n")[0];
              const location = execSync(`which ${tool}`, { stdio: ["pipe", "pipe", "ignore"] }).toString().trim();
              const isSystem = location.startsWith("/usr/bin");
  

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so there is nothing to scan for committed credentials

• authorization_granularity

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so neither the tool count nor any access-control logic can be read

Maintenance

• recency

  last commit 29 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  this repository publishes neither releases nor version tags

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  package.json declares 'MIT' but no LICENSE file ships with the source

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately