@open-mercato/ai-assistant
AI-powered chat and tool execution for Open Mercato, using MCP (Model Context Protocol) for tool discovery and execution.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Test fixture URL, not runtime code. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Negative-path unit test for protocol allowlist validation. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Passing process.env to a child process in an MCP client is a standard pattern, not exfiltration. | ai | |
| phantom-deps | phantom-dep:framer-motion | AI (phantom-deps): framer-motion is listed as a runtime dependency in package.json; phantom-dep heuristic is a false positive here. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 0.6.6 | 11 / 9 | |
| 0.6.5 | 11 / 9 | |
| 0.6.4 | 11 / 9 | |
| 0.6.3 | 11 / 9 | |
| 0.6.2 | 11 / 9 | |
| 0.6.1 | 11 / 9 | |
| 0.6.0 | 11 / 2 | |
| 0.5.0 | 11 / 2 | |
| 0.4.10 | 10 / 2 | |
| 0.4.9 | 10 / 2 | |
| 0.4.8 | 10 / 2 | |
| 0.4.7 | 10 / 2 | |
| 0.4.6 | 10 / 2 | |
| 0.4.5 | 10 / 2 |
v0.6.6
16 findingsHTTP request to raw IP address — legitimate packages use domain names 326 | apiKey: 'lm-key', 327 | modelId: '', > 328 | baseURL: 'http://192.168.1.100:1234/v1', 329 | }) 330 | expect(model).toBeDefined()
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 28 | describe('issue #2672 — MCP server-config hardening', () => { 29 | describe('validateMcpServerUrl — protocol allowlist', () => { > 30 | it.each(['file:///etc/passwd', 'gopher://example.com', 'data:text/plain,hi', 'ftp://example.com'])( 31 | 'rejects non-http(s) protocol: %s', 32 | (url) => {
HTTP request to raw IP address — legitimate packages use domain names 40 | 41 | it('accepts a public http URL', () => { > 42 | expect(validateMcpServerUrl('http://203.0.113.5:3001/mcp')).toEqual({ valid: true }) 43 | }) 44 |
HTTP request to raw IP address — legitimate packages use domain names 52 | 'http://localhost:3001/mcp', 53 | 'http://sub.localhost/mcp', > 54 | 'http://127.0.0.1/mcp', 55 | 'http://127.5.6.7/mcp', 56 | 'http://0.0.0.0/mcp',
HTTP request to raw IP address — legitimate packages use domain names 53 | 'http://sub.localhost/mcp', 54 | 'http://127.0.0.1/mcp', > 55 | 'http://127.5.6.7/mcp', 56 | 'http://0.0.0.0/mcp', 57 | 'http://10.0.0.5/mcp',
HTTP request to raw IP address — legitimate packages use domain names 54 | 'http://127.0.0.1/mcp', 55 | 'http://127.5.6.7/mcp', > 56 | 'http://0.0.0.0/mcp', 57 | 'http://10.0.0.5/mcp', 58 | 'http://172.16.0.9/mcp',
HTTP request to raw IP address — legitimate packages use domain names 55 | 'http://127.5.6.7/mcp', 56 | 'http://0.0.0.0/mcp', > 57 | 'http://10.0.0.5/mcp', 58 | 'http://172.16.0.9/mcp', 59 | 'http://172.31.255.1/mcp',
HTTP request to raw IP address — legitimate packages use domain names 56 | 'http://0.0.0.0/mcp', 57 | 'http://10.0.0.5/mcp', > 58 | 'http://172.16.0.9/mcp', 59 | 'http://172.31.255.1/mcp', 60 | 'http://192.168.1.1/mcp',
HTTP request to raw IP address — legitimate packages use domain names 57 | 'http://10.0.0.5/mcp', 58 | 'http://172.16.0.9/mcp', > 59 | 'http://172.31.255.1/mcp', 60 | 'http://192.168.1.1/mcp', 61 | 'http://169.254.169.254/latest/meta-data',
HTTP request to raw IP address — legitimate packages use domain names 58 | 'http://172.16.0.9/mcp', 59 | 'http://172.31.255.1/mcp', > 60 | 'http://192.168.1.1/mcp', 61 | 'http://169.254.169.254/latest/meta-data', 62 | 'http://[::1]/mcp',
HTTP request to raw IP address — legitimate packages use domain names 59 | 'http://172.31.255.1/mcp', 60 | 'http://192.168.1.1/mcp', > 61 | 'http://169.254.169.254/latest/meta-data', 62 | 'http://[::1]/mcp', 63 | 'http://[fe80::1]/mcp',
HTTP request to raw IP address — legitimate packages use domain names 69 | 70 | it('does not block a public host in the 172.x range outside RFC1918', () => { > 71 | expect(validateMcpServerUrl('http://172.32.0.1/mcp')).toEqual({ valid: true }) 72 | }) 73 | })
HTTP request to raw IP address — legitimate packages use domain names 78 | name: 'evil', 79 | type: 'http', > 80 | url: 'http://127.0.0.1/mcp', 81 | enabled: true, 82 | })
HTTP request to raw IP address — legitimate packages use domain names 120 | name: 'evil', 121 | type: 'http', > 122 | url: 'http://169.254.169.254/latest/meta-data', 123 | enabled: true, 124 | }),
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 141 | const { resolver, store } = makeResolver([existing]) 142 | await expect( > 143 | updateMcpServerConfig(resolver, 'mcp_existing', { url: 'file:///etc/passwd' }), 144 | ).rejects.toThrow(/Invalid MCP server config/i) 145 | expect(store.value[0]!.url).toBe('https://mcp.example.com/sse')
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.