mcp-proxy
A TypeScript SSE proxy for MCP servers that use stdio transport.
26
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
punkpeye
Keywords
MCPSSEproxy
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Move to GitHub Actions CI publish backed by SLSA/Sigstore provenance. | ai | |
| source-diff | net-exec-file:dist/stdio-BQunCFor.mjs | AI (source-diff): Bundled proxy runtime; network+exec is inherent to an MCP stdio/SSE proxy, not a dropper. | ai | |
| source-diff | net-exec-file:dist/stdio-DLSsHME0.js | AI (source-diff): Bundled tsdown/rolldown chunk; network+require are the proxy's stated function, not a dropper. | ai | |
| source-diff | net-exec-file:dist/stdio-DNR9B0BZ.mjs | AI (source-diff): Bundled proxy dist (rolldown); network+require is the package's stated SSE-proxy function. | ai | |
| source-diff | net-exec-file:dist/stdio-vt8L9uwX.mjs | AI (source-diff): HTTP proxy server + bundled Ajv new Function schema compile; benign co-occurrence in bundle | ai | |
| source-diff | net-exec-file:dist/stdio-BArgKxoc.mjs | AI (source-diff): Bundled proxy code; network+exec is the package's stated function (SSE/stdio MCP proxy). | ai | |
| source-diff | net-exec-file:dist/stdio-CvFTizsx.mjs | AI (source-diff): bundled deps (ajv/depd new Function, JWT atob) + core spawn for stdio proxy; no fetched-code exec | ai | |
| source-diff | obfuscated-file:dist/bin/mcp-proxy.mjs | AI (source-diff): Minified rolldown/tsdown bundle output, not obfuscation; regenerated each build. | ai | |
| source-diff | net-exec-file:dist/stdio-DBuYn6eo.mjs | AI (source-diff): http+spawn are core to an MCP stdio/SSE proxy; bundled build output. | ai | |
| source-diff | net-exec-file:dist/stdio-CfAxSAGj.js | AI (source-diff): Rolldown bundled output; network+require is core proxy function, not malicious loader. | ai | |
| source-diff | net-exec-file:dist/stdio-BAyQuMKu.js | AI (source-diff): Bundled proxy runtime; network+require is the package's stated function, not a loader. | ai | |
| source-diff | net-exec-file:dist/stdio-DLwYts_5.mjs | AI (source-diff): Rolldown bundle for an SSE proxy; network+crypto imports are core functionality, not malware. | ai | |
| source-diff | net-exec-file:dist/stdio-DN-u_q7a.mjs | AI (source-diff): Rolldown bundle for an SSE proxy; network + require patterns are expected library code, not malware. | ai | |
| source-diff | net-exec-file:dist/stdio-DQCs94rj.js | AI (source-diff): File is a rolldown-bundled output of the package's TypeScript source. Network usage is expected for an SSE proxy; dynamic patterns are standard CommonJS interop shims generated by the bundler, not malware. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): process.env spread occurs only in test files (proxyServer.test.ts) to pass env vars to child processes — standard test scaffolding, not production code. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP 127.0.0.1 appears only in test files for localhost test server setup — normal and expected for integration tests. | ai |
Versions (showing 26 of 26)
| Version | Deps | Published |
|---|---|---|
| 6.5.4 | 1 / 23 | |
| 6.5.3 | 1 / 23 | |
| 6.5.2 | 1 / 23 | |
| 6.5.1 | 1 / 23 | |
| 6.5.0 | 1 / 23 | |
| 6.4.6 | 1 / 23 | |
| 6.4.5 | 1 / 23 | |
| 6.4.4 | 1 / 23 | |
| 6.4.3 | 1 / 23 | |
| 6.4.2 | 1 / 23 | |
| 6.4.1 | 1 / 23 | |
| 6.4.0 | 1 / 23 | |
| 6.2.0 | 0 / 23 | |
| 6.1.10 | 0 / 23 | |
| 6.1.9 | 0 / 23 | |
| 6.1.8 | 0 / 23 | |
| 5.12.5 | 0 / 23 | |
| 5.12.4 | 0 / 23 | |
| 5.12.3 | 0 / 23 | |
| 5.12.2 | 0 / 23 | |
| 5.12.1 | 0 / 23 | |
| 5.12.0 | 0 / 23 | |
| 5.11.2 | 0 / 23 | |
| 5.11.1 | 0 / 23 | |
| 5.11.0 | 0 / 23 | |
| 5.10.0 | 0 / 23 |
v6.5.4
2 findings
HIGH
New file with network + code execution: dist/stdio-BQunCFor.mjs
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.5.3
2 findings
HIGH
New file with network + code execution: dist/stdio-DNR9B0BZ.mjs
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.