← Home

@frontmcp/testing

npm Repository Homepage

E2E testing framework for FrontMCP servers - MCP client, auth mocks, Playwright integration

30
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

davidfrontegg

Keywords

mcptestinge2eintegration-testingmcp-clientplaywrightagentfrontfrontmcpframeworktypescript

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): Test server spawning child processes with inherited env is standard; not exfiltration. ai
semgrep semgrep:base64-decode AI (semgrep): Decoding Basic Auth header is a legitimate, well-understood pattern. ai
semgrep semgrep:child-process-import AI (semgrep): E2E testing framework legitimately spawns server processes via child_process. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): tslib is a declared runtime dependency; phantom-dep heuristic is a false positive here. ai

Versions (showing 30 of 30)

Version Deps Published
1.3.0 4 / 2
1.2.1 4 / 2
1.2.0 4 / 2
1.1.2 4 / 2
1.1.1 4 / 2
1.1.0 4 / 2
1.0.4 4 / 2
1.0.3 4 / 2
1.0.2 4 / 2
1.0.1 4 / 2
1.0.0 4 / 2
0.12.2 4 / 2
0.12.1 4 / 2
0.12.0 4 / 2
0.11.3 4 / 2
0.11.2 4 / 2
0.11.1 4 / 2
0.11.0 4 / 2
0.10.0 4 / 2
0.9.0 4 / 2
0.8.1 4 / 2
0.8.0 4 / 2
0.7.2 3 / 2
0.7.1 3 / 2
0.6.3 3 / 2
0.6.2 3 / 2
0.6.1 3 / 2
0.6.0 3 / 2
0.5.1 3 / 2
0.5.0 3 / 2

v1.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.1

7 findings
HIGH env-spread: esm/fixtures/index.mjs:2672 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/5bc4d462bb67cae68f17c4eec31149687250cb69/esm/fixtures/index.mjs#L2672 2670 | } 2671 | this.log(`Starting server: ${this.options.command}`); > 2672 | const env = { 2673 | ...process.env, 2674 | ...this.options.env,

HIGH env-spread: esm/index.mjs:4279 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/5bc4d462bb67cae68f17c4eec31149687250cb69/esm/index.mjs#L4279 4277 | } 4278 | this.log(`Starting server: ${this.options.command}`); > 4279 | const env = { 4280 | ...process.env, 4281 | ...this.options.env,

HIGH env-spread: esm/perf/index.mjs:3427 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/5bc4d462bb67cae68f17c4eec31149687250cb69/esm/perf/index.mjs#L3427 3425 | } 3426 | this.log(`Starting server: ${this.options.command}`); > 3427 | const env = { 3428 | ...process.env, 3429 | ...this.options.env,

HIGH env-spread: fixtures/index.js:2688 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/5bc4d462bb67cae68f17c4eec31149687250cb69/fixtures/index.js#L2688 2686 | } 2687 | this.log(`Starting server: ${this.options.command}`); > 2688 | const env = { 2689 | ...process.env, 2690 | ...this.options.env,

HIGH env-spread: index.js:4397 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/5bc4d462bb67cae68f17c4eec31149687250cb69/index.js#L4397 4395 | } 4396 | this.log(`Starting server: ${this.options.command}`); > 4397 | const env = { 4398 | ...process.env, 4399 | ...this.options.env,

HIGH env-spread: perf/index.js:3489 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/5bc4d462bb67cae68f17c4eec31149687250cb69/perf/index.js#L3489 3487 | } 3488 | this.log(`Starting server: ${this.options.command}`); > 3489 | const env = { 3490 | ...process.env, 3491 | ...this.options.env,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.4

7 findings
HIGH env-spread: esm/fixtures/index.mjs:2670 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/b69f4d8ed3edc7de3e85ddbdcc78910339510d53/esm/fixtures/index.mjs#L2670 2668 | } 2669 | this.log(`Starting server: ${this.options.command}`); > 2670 | const env = { 2671 | ...process.env, 2672 | ...this.options.env,

HIGH env-spread: esm/index.mjs:4277 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/b69f4d8ed3edc7de3e85ddbdcc78910339510d53/esm/index.mjs#L4277 4275 | } 4276 | this.log(`Starting server: ${this.options.command}`); > 4277 | const env = { 4278 | ...process.env, 4279 | ...this.options.env,

HIGH env-spread: esm/perf/index.mjs:3425 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/b69f4d8ed3edc7de3e85ddbdcc78910339510d53/esm/perf/index.mjs#L3425 3423 | } 3424 | this.log(`Starting server: ${this.options.command}`); > 3425 | const env = { 3426 | ...process.env, 3427 | ...this.options.env,

HIGH env-spread: fixtures/index.js:2686 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/b69f4d8ed3edc7de3e85ddbdcc78910339510d53/fixtures/index.js#L2686 2684 | } 2685 | this.log(`Starting server: ${this.options.command}`); > 2686 | const env = { 2687 | ...process.env, 2688 | ...this.options.env,

HIGH env-spread: index.js:4395 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/b69f4d8ed3edc7de3e85ddbdcc78910339510d53/index.js#L4395 4393 | } 4394 | this.log(`Starting server: ${this.options.command}`); > 4395 | const env = { 4396 | ...process.env, 4397 | ...this.options.env,

HIGH env-spread: perf/index.js:3487 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/agentfront/frontmcp/blob/b69f4d8ed3edc7de3e85ddbdcc78910339510d53/perf/index.js#L3487 3485 | } 3486 | this.log(`Starting server: ${this.options.command}`); > 3487 | const env = { 3488 | ...process.env, 3489 | ...this.options.env,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.10.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.7.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.7.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.