🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
Sign In

@graneth/mcp-server

Package Overview
Dependencies
Maintainers
1
Versions
15
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@graneth/mcp-server - npm Package Compare versions

Comparing version
0.4.0
 to
0.4.1
+3
-3
dist/index.js

@@ -794,6 +794,6 @@ #!/usr/bin/env node

title: `Package "${ref.pkg}" does not exist in ${registryName}`,
description: `"${ref.pkg}" is not a real ${ref.ecosystem} package \u2014 verified in real time against the live ${registryName} (404). This is the hallmark of an AI-hallucinated dependency (slopsquatting): the model invented a plausible name, and an attacker may have already pre-registered it with malicious code. Found in \`${ref.filename}\` at line ${ref.line}.`,
description: `"${ref.pkg}" is not a real package \u2014 verified live against ${registryName} (404). This is the hallmark of an AI-hallucinated dependency (slopsquatting): the model invented a plausible name, and an attacker may have already pre-registered it with malicious code. Found in \`${ref.filename}\` at line ${ref.line}.`,
file: ref.filename,
line: ref.line,
recommendation: `Remove the import of "${ref.pkg}" immediately. Do not install it \u2014 if the name has been registered since, you may pull malicious code. Find the intended package on ${registryLabel(ref.ecosystem).site} and replace the import.`,
recommendation: `Remove the reference to "${ref.pkg}" immediately. Do not install it \u2014 if the name has been registered since, you may pull malicious code. Find the intended package on ${registryLabel(ref.ecosystem).site} and replace the reference.`,
cve: "CWE-1357"

@@ -840,3 +840,3 @@ });

// src/index.ts
var VERSION = "0.4.0";
var VERSION = "0.4.1";
var PRE_FLIGHT_CHECK_DESCRIPTION = "Security pre-flight check for local file changes BEFORE committing. Run this whenever you are about to suggest `git commit`, `git push`, or open a pull request \u2014 especially when changes add package imports or dependencies (package.json / requirements.txt / Cargo.toml / go.mod / Gemfile / composer.json / import statements) or could contain secrets. Detects AI-hallucinated (non-existent) packages by live-checking six registries (npm, PyPI, crates.io, RubyGems, Go module proxy, Packagist), plus hardcoded credentials via pattern + entropy analysis. Always free, no account required. Returns CLEAR, REVIEW_REQUIRED, or BLOCKED with specific findings and remediation.";

@@ -843,0 +843,0 @@ var PRE_FLIGHT_CHECK_SCHEMA = {

+1
-1
package.json
{
"name": "@graneth/mcp-server",
"version": "0.4.0",
"version": "0.4.1",
"description": "Account-free MCP server: catch AI-hallucinated packages (npm, PyPI, crates.io, RubyGems, Go, Packagist) and hardcoded secrets before you commit. Exposes the free pre_flight_check tool over stdio.",

@@ -5,0 +5,0 @@ "type": "module",