Tracked packageView full profile for bajaclaw →

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

npm · bajaclaw0.20.8

Item: bajaclaw
Rating: 4
Author: MCPSafe

Scanned 5/1/2026, 10:52:09 AM·Cached result·Fast Scan·45 rules·View source ↗·How we decide ↗

AIVSS Score

2.3/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagebajaclaw

Version0.20.8

SourceNPM

LicenseMIT

Publisherbackyardd

Package age12d

Stars—

Downloads/wk1.2K

Dependencies11

Findings

4 of 4 findings

medium (4)

4 findings

medium (4)

AIVSS 2.3CVSS 3.5

Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.

Evidence

bajaclaw serve                              # default: 127.0.0.1:8765
bajaclaw serve --port 9000                  # custom port
bajaclaw serve --api-key $(openssl rand -hex 32)   # with auth
bajaclaw serve --host 0.0.0.0 --api-key <secret>   # bind all interfaces (auth required)
bajaclaw serve --expose default research    # allowlist specific profiles
```

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Report false positive →

AIVSS 2.3CVSS 3.5

Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.

Evidence

```
bajaclaw serve                                      # 127.0.0.1:8765, no auth
bajaclaw serve --api-key $(openssl rand -hex 32)    # with bearer auth
bajaclaw serve --host 0.0.0.0 --api-key <key>       # bind all interfaces (auth required)
```

Each request is a full cycle: memory recall, skill matching, MCP inheritance, backend call, post-cycle extraction. The `model` field in the request is the BajaClaw profile name.

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Report false positive →

AIVSS 2.3CVSS 3.5

Package declares an install-time hook (npm postinstall/preinstall/prepare, setup.py cmdclass override, custom setuptools install class, or non-default pyproject build-backend). Anyone installing this package runs the hook. Confirm the hook is necessary and review its contents; prefer shipping a plain library without install-time execution.

Evidence

"dashboard:dev": "tsx watch src/cli.ts dashboard",
    "test": "node scripts/run-tests.js",
    "lint": "tsc --noEmit",
    "prepare": "npm run build",
    "postinstall": "node scripts/postinstall.js"
  },
  "files": [

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

"test": "node scripts/run-tests.js",
    "lint": "tsc --noEmit",
    "prepare": "npm run build",
    "postinstall": "node scripts/postinstall.js"
  },
  "files": [
    "bin/",

Remediation

Report false positive →

LLM summary— bajaclaw:0.20.8

This package receives a B grade with a safety score of 85/100 and scores 2.2/10 on the AIVSS scale, indicating moderate security posture with room for improvement. All four medium-severity findings relate to server configuration issues, which are typically addressable but should be reviewed before deployment. While no critical or high-severity vulnerabilities were detected, you should evaluate whether the configuration concerns align with your security requirements before installation.

Signal scores

CVE check100

Static100

Publisher identity10

Permissions84

Supply chain84

Typosquat100

Package health70

Community82

Secrets & exfil100

Injection risks100

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 4
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 12d ago
Source: NPM

MCP Server Information

Source: NPM
Package: bajaclaw
Version: 0.20.8
License: MIT
Publisher: backyardd
Verified: No
Added: 12 days ago
Versions: 76
Ecosystem: Node.js / npm
Downloads/wk: 1.2K
Dependencies: 11

AIVSS Score

2.3/ 10Low

Internal score: 85/100

Severity breakdown

Scan Details

Total findings4

Affected tools0 / 1

Scanned12d ago

Scan modeFAST

SourceNPM

Scan IDpubfasteea5a4065a529d8be736

Want deeper analysis?

Fast scan found 4 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

4 of 4 findings

medium (4)

4 findings

medium (4)

AIVSS 2.3CVSS 3.5

Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.

Evidence

bajaclaw serve                              # default: 127.0.0.1:8765
bajaclaw serve --port 9000                  # custom port
bajaclaw serve --api-key $(openssl rand -hex 32)   # with auth
bajaclaw serve --host 0.0.0.0 --api-key <secret>   # bind all interfaces (auth required)
bajaclaw serve --expose default research    # allowlist specific profiles
```

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Report false positive →

AIVSS 2.3CVSS 3.5

Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.

Evidence

```
bajaclaw serve                                      # 127.0.0.1:8765, no auth
bajaclaw serve --api-key $(openssl rand -hex 32)    # with bearer auth
bajaclaw serve --host 0.0.0.0 --api-key <key>       # bind all interfaces (auth required)
```

Each request is a full cycle: memory recall, skill matching, MCP inheritance, backend call, post-cycle extraction. The `model` field in the request is the BajaClaw profile name.

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

"dashboard:dev": "tsx watch src/cli.ts dashboard",
    "test": "node scripts/run-tests.js",
    "lint": "tsc --noEmit",
    "prepare": "npm run build",
    "postinstall": "node scripts/postinstall.js"
  },
  "files": [

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

"test": "node scripts/run-tests.js",
    "lint": "tsc --noEmit",
    "prepare": "npm run build",
    "postinstall": "node scripts/postinstall.js"
  },
  "files": [
    "bin/",

Remediation

Report false positive →

410	```
411	bajaclaw serve # 127.0.0.1:8765, no auth
412	bajaclaw serve --api-key $(openssl rand -hex 32) # with bearer auth
413	bajaclaw serve --host 0.0.0.0 --api-key <key> # bind all interfaces (auth required)
414	```
415
416	Each request is a full cycle: memory recall, skill matching, MCP inheritance, backend call, post-cycle extraction. The `model` field in the request is the BajaClaw profile name.

410	```
411	bajaclaw serve # 127.0.0.1:8765, no auth
412	bajaclaw serve --api-key $(openssl rand -hex 32) # with bearer auth
413	bajaclaw serve --host 0.0.0.0 --api-key <key> # bind all interfaces (auth required)
414	```
415
416	Each request is a full cycle: memory recall, skill matching, MCP inheritance, backend call, post-cycle extraction. The `model` field in the request is the BajaClaw profile name.

32	bajaclaw serve # default: 127.0.0.1:8765
33	bajaclaw serve --port 9000 # custom port
34	bajaclaw serve --api-key $(openssl rand -hex 32) # with auth
35	bajaclaw serve --host 0.0.0.0 --api-key <secret> # bind all interfaces (auth required)
36	bajaclaw serve --expose default research # allowlist specific profiles
37	```

17	"dashboard:dev": "tsx watch src/cli.ts dashboard",
18	"test": "node scripts/run-tests.js",
19	"lint": "tsc --noEmit",
20	"prepare": "npm run build",
21	"postinstall": "node scripts/postinstall.js"
22	},
23	"files": [