io.github.yaver-io/yaver

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/bundler.js:103mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    ].join(' ');
  
    execSync(cmd, { stdio: 'inherit' });
  
    if (!fs.existsSync(bundlePath)) {

• src/commands/doctor.js:12mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

  function commandExists(name) {
    try {
      execSync(`command -v ${name}`, { stdio: ['ignore', 'pipe', 'ignore'] });
      return true;
    } catch (_) {

• src/commands/doctor.js:12mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

  function commandExists(name) {
    try {
      execSync(`command -v ${name}`, { stdio: ['ignore', 'pipe', 'ignore'] });
      return true;
    } catch (_) {

• src/postinstall.js:138mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      }
      execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] });
      execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {
        stdio: "inherit",
      });

• src/postinstall.js:138mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      }
      execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] });
      execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {
        stdio: "inherit",
      });

• src/postinstall.js:167mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      }
      execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] });
      execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${missing.join(" ")}`, {
        stdio: "inherit",
      });

• src/postinstall.js:167mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      }
      execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] });
      execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${missing.join(" ")}`, {
        stdio: "inherit",
      });

• src/postinstall.js:230mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    const labels = missing.map((entry) => entry.label).join(", ");
    try {
      execSync(
        `"${npmCmd}" install -g --no-fund --no-audit ${packages.join(" ")}`,
        { stdio: "inherit" },

• src/postinstall.js:230mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    const labels = missing.map((entry) => entry.label).join(", ");
    try {
      execSync(
        `"${npmCmd}" install -g --no-fund --no-audit ${packages.join(" ")}`,
        { stdio: "inherit" },

• src/postinstall.js:311mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    if (!hasPW) {
      try {
        execSync(`"${npmCmd}" install -g --no-fund --no-audit playwright`, { stdio: "inherit" });
        log("Installed Playwright test driver (web-playwright target).");
      } catch (error) {

• src/postinstall.js:311mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    if (!hasPW) {
      try {
        execSync(`"${npmCmd}" install -g --no-fund --no-audit playwright`, { stdio: "inherit" });
        log("Installed Playwright test driver (web-playwright target).");
      } catch (error) {

• src/postinstall.js:493mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      for (const unit of ["yaver", "yaver-agent"]) {
        try {
          execSync(
            `systemctl is-active ${unit} >/dev/null 2>&1 && systemctl restart ${unit}`,
            { stdio: "ignore", shell: "/bin/sh" },

• src/postinstall.js:493mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

      for (const unit of ["yaver", "yaver-agent"]) {
        try {
          execSync(
            `systemctl is-active ${unit} >/dev/null 2>&1 && systemctl restart ${unit}`,
            { stdio: "ignore", shell: "/bin/sh" },

• src/agent-runtime.js:711mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
  async function fetchLatestRelease(repo) {
    const response = await request(`https://api.github.com/repos/${repo}/releases?per_page=20`, {
      headers: {
        'User-Agent': `yaver-cli/${PACKAGE.version}`,

• src/agent-runtime.js:750mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
  async function downloadToFile(url, destPath) {
    const response = await request(url);
    if (response.statusCode && response.statusCode >= 400) {
      throw new Error(`download failed (${response.statusCode}) from ${url}. Publish the matching CLI release assets or set YAVER_AGENT_BIN.`);

• src/agent-runtime.js:761mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      https.get(url, options, (response) => {
        if (response.statusCode && response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
          resolve(request(response.headers.location, options));
          return;
        }

• src/commands/desktop.js:129mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
          response.resume();
          resolve(request(response.headers.location, options));
          return;
        }

• src/commands/desktop.js:147mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
  async function download(url, destination) {
    const response = await request(url, { headers: { Accept: "application/octet-stream" } });
    if (response.statusCode !== 200) {
      const body = await responseText(response);

• src/commands/desktop.js:170mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  async function resolveDownload({ platform, arch, format, version = "" }) {
    const repo = process.env.YAVER_DESKTOP_REPO || DEFAULT_REPO;
    const response = await request(`https://api.github.com/repos/${repo}/releases?per_page=100`);
    if (response.statusCode !== 200) throw new Error(`Desktop release lookup failed (HTTP ${response.statusCode}).`);
    const release = parseGuiRelease(JSON.parse(await responseText(response)), version || process.env.YAVER_DESKTOP_VERSION);

• src/hermesc-runtime.js:103mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

            res.resume();
            const next = new URL(res.headers.location, u).toString();
            fetch(next, redirectsLeft - 1);
            return;
          }

• src/hermesc-runtime.js:128mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        });
      };
      fetch(url, maxRedirects);
    });
  }

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 5 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (1 issue(s) in the last 6 months, under `03` §5's floor of 3): 95.1 day(s) to first maintainer comment

• release_cadence

  released 6 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  hermesc/README.md: over the size floor but none of `03` §7's content heuristics matched

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately