preflight

https://github.com/8beeeaaat/touchdesigner-mcp

touchdesigner-mcp

Caution

Score 73 / 100 · 80 files read · 0 critical, 0 high, 4 medium, 8 low findings

Report af18dfeb1429ea66 · first scanned 2026-10-28 · scanned 4× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials84
exfiltration92
execution76
injection100
obfuscation100
files100

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCan run shell commands from code
.claude/hooks/integration-test-guard.mjs · line 16 · rule M1
leSync } from "node:child_process"; const API_RE = /^(src\/api\/|src\/features\/tools\/|src\/server\/|src\/tdClient\/|src\/trans
mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions
(package) · line 1 · rule M3
static.modelcontextprotocol.io
mediumCan run shell commands from code
scripts/runPythonTests.mjs · line 18 · rule M1
wnSync } from "node:child_process"; import { readFileSync } from "node:fs"; import { dirname, join } from "node:path"; import { fi
mediumCan run shell commands from code
scripts/syncMcpServerVersions.ts · line 1 · rule M1
leSync } from "node:child_process"; import { existsSync, readFileSync, writeFileSync } from "node:fs"; import { dirname, join } fr
lowReads named environment variables (normal for API keys; listed in the permission summary)
.claude/hooks/integration-test-guard.mjs · line 57 · rule L1
rocess.exit(0); if (process.env.SKIP_ITEST_GUARD === "1") process.exit(0); const cwd = input.cwd || process.env.CLAUDE_PROJECT_DI
lowReads named environment variables (normal for API keys; listed in the permission summary)
plugin/touchdesigner/hooks/scripts/td-config-context.mjs · line 24 · rule L1
const storedHost = process.env.CLAUDE_PLUGIN_OPTION_TOUCHDESIGNER_HOST; const storedPort = process.env.CLAUDE_PLUGIN_OPTION_TOUCH
lowReads named environment variables (normal for API keys; listed in the permission summary)
scripts/formatPreview.ts · line 70 · rule L1
function main() { process.env.TD_WEB_SERVER_HOST ||= "http://127.0.0.1"; process.env.TD_WEB_SERVER_PORT ||= "9981"; const ser
lowReads named environment variables (normal for API keys; listed in the permission summary)
scripts/measureFormatterImpact.ts · line 81 · rule L1
function main() { process.env.TD_WEB_SERVER_HOST ||= "http://127.0.0.1"; process.env.TD_WEB_SERVER_PORT ||= "9981"; const tdC
lowReads named environment variables (normal for API keys; listed in the permission summary)
scripts/runPythonTests.mjs · line 26 · rule L1
onst isCI = Boolean(process.env.CI); /** * @param {string} command * @param {string[]} args */ function run(command, args) {
lowReads named environment variables (normal for API keys; listed in the permission summary)
scripts/showDetailedNodes.ts · line 55 · rule L1
function main() { process.env.TD_WEB_SERVER_HOST ||= "http://127.0.0.1"; process.env.TD_WEB_SERVER_PORT ||= "9981"; const ser
lowReads named environment variables (normal for API keys; listed in the permission summary)
src/api/customInstance.ts · line 12 · rule L1
=> { const host = process.env.TD_WEB_SERVER_HOST; const port = process.env.TD_WEB_SERVER_PORT; if (!host || !port) { throw n
lowReads named environment variables (normal for API keys; listed in the permission summary)
src/cli.ts · line 169 · rule L1
gs(params?.argv); process.env.TD_WEB_SERVER_HOST = args.host; process.env.TD_WEB_SERVER_PORT = args.port.toString(); // Han

Permission surface

Network endpoints
cloud.google.comdevelopers.openai.comdocs.derivative.cagithub.comhost.docker.internalimg.shields.iokeepachangelog.commodelcontextprotocol.ionodejs.orgsemver.orgsocket.devstatic.modelcontextprotocol.iothehackernews.comwww.npmjs.comwww.stepsecurity.ioyoutu.be
Environment read
CICLAUDE_PLUGIN_OPTION_TOUCHDESIGNER_HOSTCLAUDE_PLUGIN_OPTION_TOUCHDESIGNER_PORTCLAUDE_PROJECT_DIRNODE_ENVSKIP_ITEST_GUARDTD_WEB_SERVER_HOSTTD_WEB_SERVER_PORT
Shell execution
yes — code or scripts can run shell commands
Install hooks
none
Credential material
Reads named environment variables (normal for API keys; listed in the permission summary)

Provenance

Source
GitHub
Repository
8beeeaaat/touchdesigner-mcp
Owner
8beeeaaat
Stars
605
Forks
65
Repo created
2025-04-13
Last push
2026-10-12
License
MIT

Badge for the author

Preflight grade

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/af18dfeb1429ea66.svg)](https://preflight.orbitaldeskllc.com/b/af18dfeb1429ea66)

The badge links back to this report and updates if the package is re-scanned at a new version.

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/af18dfeb1429ea66