code-graph@0.188.0
CAUTION· startup onlyPublisher claims: "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher sdsrs · publishing for 248 daysInstalls 12,816Last detonated 7d ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
Code inventory arrives with this version's next honeypot run.- It will ask for
- unknown until the next run
- Where it talks to
- unknown until the next run
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Not enough was observed to say yet. Startup only; authenticated tool behavior not tested. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try code-graph` runs it now and prints the full answer.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-07 and scored it 66/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
0.3sfilesystemread ~/.cache/code-graph/binary-path outside project
0.3sprocessexec /usr/bin/date
0.3sprocessexec /usr/bin/timeout
0.3sprocessexec /app/apps/web/node_modules/.bin/npm
0.3sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm
0.3sprocessexec /app/node_modules/.bin/npm
0.3sprocessexec /pnpm/npm
0.3sprocessexec /usr/local/sbin/npm
0.3sprocessexec /usr/local/bin/npm
0.3sprocessexec /app/apps/web/node_modules/.bin/which
0.3sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/which
0.3sprocessexec /app/node_modules/.bin/which
0.3sprocessexec /pnpm/which
0.3sprocessexec /usr/local/sbin/which
0.3sprocessexec /usr/local/bin/which
0.3sprocessexec /usr/sbin/which
0.3sprocessexec /usr/bin/which
0.3sclaimedno tools/list reply (exit 0)
0.3sprocessscript backend runs setup only
0.3sprocessno install scripts to re-run
Static findings
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:1438 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06`[code-graph] Auto-update to v${latest.version} suspended after ${attempts} failed attempts on this machine. ` +Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:997 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06return `auto-update is SUSPENDED after ${state.updateAttempts} failed attempts on v${state.latestVersion} `Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:216 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// The updater's main trigger is `launchBackgroundAutoUpdate` in session-init.js:Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:821 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06`Auto-update skipped: missing required tools: ${missingTools.join(', ')}. Install them to enable auto-updates.`)}`);Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:824 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// `auto-update.js check` has NO non-zero exit path: dev mode, the opt-out,Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/find-binary.js:58 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06* `auto-update.clearCache()`) is exactly when the chain is longest and everyFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/find-binary.js:277 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// an auto-update, on the hook path (JS-23 / pre-ship review 2026-09-07).Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Privileged sudo commandclaude-plugin/scripts/find-binary.js:163 · Privileged sudo command — agent may execute with elevated privileges
AST05// 3. Common no-sudo user prefixFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/cache-paths.js:28 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06/** Auto-update bookkeeping: available version, attempt counters, last error. */Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:790 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06* Auto-update writes the plugin cache + installed_plugins.json directly andFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:1314 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// bypasses auto-update.js, so re-sync state.installedVersion every call.Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:917 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01'Edit CLAUDE.md manually to opt in.';Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/session-init.js:57 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01// hook used to write there — "CLAUDE.md was modified", "hooks look dark",Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:763 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06* was gone — re-opening the 41 MB auto-update race the tombstone closes, sinceFix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:946 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01else lines.push('[code-graph] CLAUDE.md block already up-to-date — no write');Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:985 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06* Why a just-run `auto-update.js check` can have done nothing, in the updater'sFix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/cli-entry.js:18 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01* they write `<cwd>/CLAUDE.md`, `<cwd>/.claude/` and `~/.cache/code-graph`, andFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:991 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06function autoUpdateNoOpReason(state = readUpdateState(), env = process.env) {Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:995 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01' Refusing rather than guessing: both verbs write to your CLAUDE.md.\n');Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/find-binary.js:497 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06* Why: candidates below the auto-update cache had no version check at all, soFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/lifecycle.js:2174 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// `launchBackgroundAutoUpdate`. SessionStart is still the racing surface,Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/session-init.js:582 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// self-heals through the background auto-update (decision D5).Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/lifecycle.js:2346 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// auto-update. Deferring this one edge to call time is the only thing thatFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/session-init.js:183 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// auto-update installs a newer version, those old scripts would seeFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/lifecycle.js:2241 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06backupCorruptFile, pruneCorruptBackups, MAX_CORRUPT_BACKUPS, // auto-update.js repoints installed_plugins.json and owes the same preserve-then-proceedFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/proc-opts.js:12 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06* (issue #40); the auto-update treadmill fixed alongside it made that perFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsclaude-plugin/scripts/session-init.js:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...env, CODE_GRAPH_AUTO_UPDATE_SILENT: '1' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:639 · npx invocation of non-well-known package — may execute untrusted code
AST06// Same hoisted-or-nested question as the global prefix — an npx tree isFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandclaude-plugin/scripts/cache-paths.js:110 · Process kill command — agent can terminate processes
AST05// kill switch this design's TTL exists to prevent, in bounded form, and it isFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/session-init.js:799 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06autoUpdateLaunched, indexFreshness, mapInjected, binaryCheck, consistencyIssues,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:635 · npx invocation of non-well-known package — may execute untrusted code
AST06// --- npx cache (very last resort — may be outdated) ---Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandclaude-plugin/scripts/doctor.js:1276 · File permission modification command — agent changes file ownership/permissions
AST05// skipped. Without this arm a chmod on ~/.claude was diagnosed asFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:373 · npx invocation of non-well-known package — may execute untrusted code
AST06* cargo install → PATH → npx cacheFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/adopt.js:742 · npx invocation of non-well-known package — may execute untrusted code
AST06// .claude/ detail 文件）。/plugin install 本身已构成知情同意；npm / npx / 裸 checkoutFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandclaude-plugin/scripts/cache-paths.js:68 · Process kill command — agent can terminate processes
AST05* binary. The TTL is what keeps this from becoming a permanent kill switch —Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandclaude-plugin/scripts/doctor.js:1203 · File permission modification command — agent changes file ownership/permissions
AST05console.log(`\n \u2705 Fixed permissions: chmod +x ${binary}`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandclaude-plugin/scripts/auto-update.js:735 · File permission modification command — agent changes file ownership/permissions
AST05// chmod BEFORE reading the version. readBinaryVersion executes the binaryFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/tmp-dir.js:112 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// `update-*` staging dirs from an interrupted auto-update are the onlyFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionclaude-plugin/scripts/doctor.js:541 · File type combined with upload action — agent may exfiltrate local data files
AST07// silently ignores plugin-cache hooks.json for PreToolUse/PostToolUse/Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionclaude-plugin/templates/code-graph-snapshot.yml:40 · File type combined with upload action — agent may exfiltrate local data files
AST07# its checksum beside it as `<name>.db.zst.blake3`. Upload both: installFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commandclaude-plugin/scripts/lifecycle.js:71 · File permission modification command — agent changes file ownership/permissions
AST05// unparseable case and left the unreadable one behind — a `chmod 000`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandclaude-plugin/scripts/session-init.js:473 · File permission modification command — agent changes file ownership/permissions
AST05`Fix: chmod +x "${binary}"` +Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/lifecycle.js:826 · npx invocation of non-well-known package — may execute untrusted code
AST06lines.push(' `npx -y @sdsrs/code-graph unadopt` in the project:');Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionclaude-plugin/scripts/lifecycle.js:320 · File type combined with upload action — agent may exfiltrate local data files
AST07// settings.json the user had put at 0600 came back 0644 on the firstFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandclaude-plugin/scripts/pre-read-guide.js:242 · Process kill command — agent can terminate processes
AST05// the former is the healthy-hook-answers-nothing case NEW-08 traded a killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandclaude-plugin/scripts/lifecycle.js:350 · File permission modification command — agent changes file ownership/permissions
AST05// umask can only have cleared bits the original had, so chmod is what makesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packageclaude-plugin/templates/code-graph-snapshot.yml:13 · npx invocation of non-well-known package — may execute untrusted code
AST06# name belongs to an unrelated publisher on npm, and `npx -y` would install andFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandclaude-plugin/scripts/mcp-launcher.js:208 · File permission modification command — agent changes file ownership/permissions
AST05process.stderr.write(`Fix: chmod +x "${binary}"\n`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:39 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01// `followLink` is opt-in, and ONLY the CLAUDE.md read-modify-write passes it.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packageclaude-plugin/templates/code-graph-snapshot.yml:12 · npx invocation of non-well-known package — may execute untrusted code
AST06# inside it). Do NOT shorten this to `npx -y code-graph-mcp` — that unscopedFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:646 · npx invocation of non-well-known package — may execute untrusted code
AST06} catch { /* no npx cache */ }Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageclaude-plugin/templates/code-graph-snapshot.yml:44 · npx invocation of non-well-known package — may execute untrusted code
AST06npx -y -p @sdsrs/[email protected] code-graph-mcp snapshot create --out "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandclaude-plugin/scripts/mcp-launcher.js:205 · File permission modification command — agent changes file ownership/permissions
AST05` chmod +x "${binary}"\n`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandclaude-plugin/scripts/lifecycle.js:485 · File permission modification command — agent changes file ownership/permissions
AST05// durable backup — one `chmod 000` (a stray sudo, a restrictive umask) and theFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actionclaude-plugin/scripts/lifecycle.js:929 · File type combined with upload action — agent may exfiltrate local data files
AST07// hooks from cache/<mp>/<plugin>/<ver>/hooks/hooks.json. PreToolUse, PostToolUse,Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandclaude-plugin/scripts/pre-grep-guide.js:2379 · Process kill command — agent can terminate processes
AST05// within 60 s still lands in the cooldown `observe` branch above. A killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈560 tok
2 files · 49 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @sdsrs/code-graph@0.188.0 as of 7d ago. This is the package itself, not its dependencies.
What would make this Verified
14 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim sdsrs: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sdsrsPropose a patch to the maintainer