bce-engine@0.6.0

CAUTION

Publisher claims: "bce — the blueprint conformance engine. Author an EngineeringBlueprint and gate code against it with deterministic scores, fail-closed verdicts, and re-derivable evidence. TypeScript/JavaScript AST extraction covers framework surfaces and direct module bo" Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher blueprint-conformance · joined 0 days agoInstalls 31,761Last detonated 59 min ago

Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM

File type combined with upload actiondist/mcp-server.cjs:9400 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondist/mcp-server.js:9374 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagesrc/cli.ts:1150 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagesrc/cli.ts:1186 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Access to sensitive file pathssrc/proposal-io.ts:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagesrc/cli.ts:1147 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionsrc/mcp-server.ts:249 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packageREADME.md:101 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Hidden zero-width characters detecteddist/mcp-server.js:4082 · Hidden zero-width characters detected — may conceal content

AST07

HIGH

npx invocation of non-well-known packageREADME.md:100 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:92 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Hidden zero-width characters detecteddist/mcp-server.cjs:4108 · Hidden zero-width characters detected — may conceal content

AST07