Talon MCP Server

Findings (61)

• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Contacts a hard-coded IP address instead of a domain name.

  src/core/tools/ops/mesh.ts:342
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Very long encoded string literal. Often used to hide a payload.

  src/native/blake3-wasm-bytes.ts:7
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Very long encoded string literal. Often used to hide a payload.

  src/native/textops-wasm-bytes.ts:7
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/client@2.0.0: 2 known vulnerabilities

  GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.30.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.18.1: 12 known vulnerabilities

  GHSA-3pq3-5fj3-cg6v, GHSA-44g4-m2mj-wpvx, GHSA-4hqw-qxg8-jxx2, GHSA-542g-h47m-68v8, GHSA-9fr6-4gfg-395g +7 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 2 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-27r3-jxmh-p828

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.0: 3 known vulnerabilities

  GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  sharp@0.35.4: 1 known vulnerability

  GHSA-wq5f-xc86-pv6w

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@6.28.0: 8 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm +3 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.29.0: 18 known vulnerabilities

  GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +13 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@8.10.2: 8 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.3.0: 6 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 2 known vulnerabilities

  GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.3.6: 2 known vulnerabilities

  GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.6.5: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.1: 1 known vulnerability

  GHSA-mrwp-f3q8-3g9p

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@6.29.0: 5 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.30.0: 8 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@8.12.1: 8 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install or build failed in a clean environment

  pm error notsup Not compatible with your version of node/npm: talon-agent@5.39.5 npm error notsup Required: {"node":">=24.15"} npm error notsup Actual: {"npm":"10.9.9","node":"v22.23.4"} npm error A complete log of this run can be found in: /tmp/home/.npm/_logs/2026-11-05T22_57_08_059Z-debug-0.log
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/fetch-ladder.test.ts:370
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/fetch-url-guard.test.ts:66
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/__tests__/integration/telegram-live/discover-chat.mjs:39
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/mesh-service.test.ts:1732
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/node-provision.test.ts:22
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/__tests__/node-provision.test.ts:89
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/__tests__/node-provision.test.ts:108
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/__tests__/node-provision.test.ts:147
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/node-provision.test.ts:166
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/node-provision.test.ts:167
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/__tests__/node-provision.test.ts:178
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/__tests__/node-provision.test.ts:291
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/node-provision.test.ts:302
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/__tests__/node-provision.test.ts:306
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/node-provision.test.ts:306
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/whatsapp-documents.test.ts:169
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: pkcs12-file

  apps/companion/test/fixtures/client.p12
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: private-key

  apps/companion/test/fixtures/bridge-key.pem:1
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  protocol/fixtures/auth_v1.json:29
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/__tests__/sender-tool-scope.test.ts:368
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.17: 2 known vulnerabilities

  GHSA-rmxm-3fg6-px4f, GHSA-rmxm-3fg6-px4f

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@5.0.1: 2 known vulnerabilities

  GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-copy@4.0.3: 1 known vulnerability

  GHSA-jggr-w7fw-pc2j

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.7: 5 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.13.7: 1 known vulnerability

  GHSA-5r4p-p66f-jhc7

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.4.0: 5 known vulnerabilities

  GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  music-metadata@11.15.0: 4 known vulnerabilities

  GHSA-53v6-4h7p-p4gj, GHSA-5gfj-9q3v-qfp3, GHSA-f94x-6692-553q, GHSA-jjpr-9cvf-cq55

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.16.0: 2 known vulnerabilities

  GHSA-6pq8-jhm2-2vcw, GHSA-6pq8-jhm2-2vcw

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  smol-toml@1.8.0: 1 known vulnerability

  GHSA-r4xh-jqrq-34v2

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  crossbeam-epoch@0.9.18: 1 known vulnerability

  RUSTSEC-2026-0204

  native/blake3-napi/Cargo.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  memmap2@0.9.10: 1 known vulnerability

  RUSTSEC-2026-0186

  native/blake3-napi/Cargo.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.8: 4 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.7.2: 1 known vulnerability

  GHSA-rxp7-6hxx-x8q5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)
• infoInfo. A note about the project, not a problem.
  Ignored the repo's scanner suppression config (2 files)

  .gitleaks.toml, .gitleaksignore

Network activity