ICUICU
critical

graphlit-mcp-server

v1.0.20260112001

Graphlit MCP Server

npmkirkmarpleFirst seen Feb 22, 2026

116

Total

73

Critical

26

High

17

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1848:                 process.exit(1);
    1849:             }
>>> 1850:             const clientSecret = process.env.SHAREPOINT_CLIENT_SECRET;
    1851:             if (!clientSecret) {
    1852:                 console.error("Please set SHAREPOINT_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1305:   
    1306:           try {
>>> 1307:           const clientId = process.env.MICROSOFT_TEAMS_CLIENT_ID;
    1308:           if (!clientId) {
    1309:               console.error("Please set MICROSOFT_TEAMS_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1311:           }
    1312:   
>>> 1313:           const clientSecret = process.env.MICROSOFT_TEAMS_CLIENT_SECRET;
    1314:           if (!clientSecret) {
    1315:               console.error("Please set MICROSOFT_TEAMS_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1317:           }
    1318:   
>>> 1319:           const refreshToken = process.env.MICROSOFT_TEAMS_REFRESH_TOKEN;
    1320:           if (!refreshToken) {
    1321:               console.error("Please set MICROSOFT_TEAMS_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1362:   
    1363:           try {
>>> 1364:           const clientId = process.env.MICROSOFT_TEAMS_CLIENT_ID;
    1365:           if (!clientId) {
    1366:               console.error("Please set MICROSOFT_TEAMS_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1368:           }
    1369:   
>>> 1370:           const clientSecret = process.env.MICROSOFT_TEAMS_CLIENT_SECRET;
    1371:           if (!clientSecret) {
    1372:               console.error("Please set MICROSOFT_TEAMS_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1374:           }
    1375:   
>>> 1376:           const refreshToken = process.env.MICROSOFT_TEAMS_REFRESH_TOKEN;
    1377:           if (!refreshToken) {
    1378:               console.error("Please set MICROSOFT_TEAMS_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1412:         const client = new Graphlit();
    1413:         try {
>>> 1414:             const token = process.env.NOTION_API_KEY;
    1415:             if (!token) {
    1416:                 console.error("Please set NOTION_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1452:         const client = new Graphlit();
    1453:         try {
>>> 1454:             const appKey = process.env.DROPBOX_APP_KEY;
    1455:             const appSecret = process.env.DROPBOX_APP_SECRET;
    1456:             const refreshToken = process.env.DROPBOX_REFRESH_TOKEN;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1453:         try {
    1454:             const appKey = process.env.DROPBOX_APP_KEY;
>>> 1455:             const appSecret = process.env.DROPBOX_APP_SECRET;
    1456:             const refreshToken = process.env.DROPBOX_REFRESH_TOKEN;
    1457:             if (!appKey || !appSecret || !refreshToken) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1454:             const appKey = process.env.DROPBOX_APP_KEY;
    1455:             const appSecret = process.env.DROPBOX_APP_SECRET;
>>> 1456:             const refreshToken = process.env.DROPBOX_REFRESH_TOKEN;
    1457:             if (!appKey || !appSecret || !refreshToken) {
    1458:                 console.error("Please set DROPBOX_APP_KEY, DROPBOX_APP_SECRET, and DROPBOX_REFRESH_TOKEN environment variables.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1496:         const client = new Graphlit();
    1497:         try {
>>> 1498:             const clientId = process.env.BOX_CLIENT_ID;
    1499:             const clientSecret = process.env.BOX_CLIENT_SECRET;
    1500:             const refreshToken = process.env.BOX_REFRESH_TOKEN;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1497:         try {
    1498:             const clientId = process.env.BOX_CLIENT_ID;
>>> 1499:             const clientSecret = process.env.BOX_CLIENT_SECRET;
    1500:             const refreshToken = process.env.BOX_REFRESH_TOKEN;
    1501:             if (!clientId || !clientSecret || !refreshToken) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1498:             const clientId = process.env.BOX_CLIENT_ID;
    1499:             const clientSecret = process.env.BOX_CLIENT_SECRET;
>>> 1500:             const refreshToken = process.env.BOX_REFRESH_TOKEN;
    1501:             if (!clientId || !clientSecret || !refreshToken) {
    1502:                 console.error("Please set BOX_CLIENT_ID, BOX_CLIENT_SECRET, and BOX_REFRESH_TOKEN environment variables.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1535:         const client = new Graphlit();
    1536:         try {
>>> 1537:             const token = process.env.DISCORD_BOT_TOKEN;
    1538:             if (!token) {
    1539:                 console.error("Please set DISCORD_BOT_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1572:         const client = new Graphlit();
    1573:         try {
>>> 1574:             const token = process.env.DISCORD_BOT_TOKEN;
    1575:             if (!token) {
    1576:                 console.error("Please set DISCORD_BOT_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1610:         const client = new Graphlit();
    1611:         try {
>>> 1612:             const token = process.env.NOTION_API_KEY;
    1613:             if (!token) {
    1614:                 console.error("Please set NOTION_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1645:         const client = new Graphlit();
    1646:         try {
>>> 1647:             const clientId = process.env.GOOGLE_CLIENT_ID;
    1648:             const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
    1649:             const refreshToken = process.env.GOOGLE_REFRESH_TOKEN;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1646:         try {
    1647:             const clientId = process.env.GOOGLE_CLIENT_ID;
>>> 1648:             const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
    1649:             const refreshToken = process.env.GOOGLE_REFRESH_TOKEN;
    1650:             if (!clientId || !clientSecret || !refreshToken) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1647:             const clientId = process.env.GOOGLE_CLIENT_ID;
    1648:             const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
>>> 1649:             const refreshToken = process.env.GOOGLE_REFRESH_TOKEN;
    1650:             if (!clientId || !clientSecret || !refreshToken) {
    1651:                 console.error("Please set GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_REFRESH_TOKEN environment variables.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1684:         const client = new Graphlit();
    1685:         try {
>>> 1686:             const clientId = process.env.MICROSOFT_CLIENT_ID;
    1687:             const clientSecret = process.env.MICROSOFT_CLIENT_SECRET;
    1688:             const refreshToken = process.env.MICROSOFT_REFRESH_TOKEN;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1685:         try {
    1686:             const clientId = process.env.MICROSOFT_CLIENT_ID;
>>> 1687:             const clientSecret = process.env.MICROSOFT_CLIENT_SECRET;
    1688:             const refreshToken = process.env.MICROSOFT_REFRESH_TOKEN;
    1689:             if (!clientId || !clientSecret || !refreshToken) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1686:             const clientId = process.env.MICROSOFT_CLIENT_ID;
    1687:             const clientSecret = process.env.MICROSOFT_CLIENT_SECRET;
>>> 1688:             const refreshToken = process.env.MICROSOFT_REFRESH_TOKEN;
    1689:             if (!clientId || !clientSecret || !refreshToken) {
    1690:                 console.error("Please set MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, and MICROSOFT_REFRESH_TOKEN environment variables.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1723:         const client = new Graphlit();
    1724:         try {
>>> 1725:             const apiKey = process.env.LINEAR_API_KEY;
    1726:             if (!apiKey) {
    1727:                 console.error("Please set LINEAR_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1758:         const client = new Graphlit();
    1759:         try {
>>> 1760:             const botToken = process.env.SLACK_BOT_TOKEN;
    1761:             if (!botToken) {
    1762:                 console.error("Please set SLACK_BOT_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1793:         const client = new Graphlit();
    1794:         try {
>>> 1795:             const clientId = process.env.SHAREPOINT_CLIENT_ID;
    1796:             if (!clientId) {
    1797:                 console.error("Please set SHAREPOINT_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1798:                 process.exit(1);
    1799:             }
>>> 1800:             const clientSecret = process.env.SHAREPOINT_CLIENT_SECRET;
    1801:             if (!clientSecret) {
    1802:                 console.error("Please set SHAREPOINT_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1803:                 process.exit(1);
    1804:             }
>>> 1805:             const refreshToken = process.env.SHAREPOINT_REFRESH_TOKEN;
    1806:             if (!refreshToken) {
    1807:                 console.error("Please set SHAREPOINT_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1843:         const client = new Graphlit();
    1844:         try {
>>> 1845:             const clientId = process.env.SHAREPOINT_CLIENT_ID;
    1846:             if (!clientId) {
    1847:                 console.error("Please set SHAREPOINT_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1853:                 process.exit(1);
    1854:             }
>>> 1855:             const refreshToken = process.env.SHAREPOINT_REFRESH_TOKEN;
    1856:             if (!refreshToken) {
    1857:                 console.error("Please set SHAREPOINT_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1914:         const client = new Graphlit();
    1915:         try {
>>> 1916:             const accountName = process.env.SHAREPOINT_ACCOUNT_NAME;
    1917:             if (!accountName) {
    1918:                 console.error("Please set SHAREPOINT_ACCOUNT_NAME environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1919:                 process.exit(1);
    1920:             }
>>> 1921:             const clientId = process.env.SHAREPOINT_CLIENT_ID;
    1922:             if (!clientId) {
    1923:                 console.error("Please set SHAREPOINT_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1924:                 process.exit(1);
    1925:             }
>>> 1926:             const clientSecret = process.env.SHAREPOINT_CLIENT_SECRET;
    1927:             if (!clientSecret) {
    1928:                 console.error("Please set SHAREPOINT_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1929:                 process.exit(1);
    1930:             }
>>> 1931:             const refreshToken = process.env.SHAREPOINT_REFRESH_TOKEN;
    1932:             if (!refreshToken) {
    1933:                 console.error("Please set SHAREPOINT_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2006:         const client = new Graphlit();
    2007:         try {
>>> 2008:             const clientId = process.env.ONEDRIVE_CLIENT_ID;
    2009:             if (!clientId) {
    2010:                 console.error("Please set ONEDRIVE_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2011:                 process.exit(1);
    2012:             }
>>> 2013:             const clientSecret = process.env.ONEDRIVE_CLIENT_SECRET;
    2014:             if (!clientSecret) {
    2015:                 console.error("Please set ONEDRIVE_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2016:                 process.exit(1);
    2017:             }
>>> 2018:             const refreshToken = process.env.ONEDRIVE_REFRESH_TOKEN;
    2019:             if (!refreshToken) {
    2020:                 console.error("Please set ONEDRIVE_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2096:             var refreshToken;
    2097:             var authenticationType = GoogleDriveAuthenticationTypes.ServiceAccount;
>>> 2098:             const serviceAccountJson = process.env.GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON;
    2099:             if (!serviceAccountJson) {
    2100:                 authenticationType = GoogleDriveAuthenticationTypes.User;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2099:             if (!serviceAccountJson) {
    2100:                 authenticationType = GoogleDriveAuthenticationTypes.User;
>>> 2101:                 clientId = process.env.GOOGLE_DRIVE_CLIENT_ID;
    2102:                 if (!clientId) {
    2103:                     console.error("Please set GOOGLE_DRIVE_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2104:                     process.exit(1);
    2105:                 }
>>> 2106:                 clientSecret = process.env.GOOGLE_DRIVE_CLIENT_SECRET;
    2107:                 if (!clientSecret) {
    2108:                     console.error("Please set GOOGLE_DRIVE_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2109:                     process.exit(1);
    2110:                 }
>>> 2111:                 refreshToken = process.env.GOOGLE_DRIVE_REFRESH_TOKEN;
    2112:                 if (!refreshToken) {
    2113:                     console.error("Please set GOOGLE_DRIVE_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2186:         const client = new Graphlit();
    2187:         try {
>>> 2188:             const appKey = process.env.DROPBOX_APP_KEY;
    2189:             if (!appKey) {
    2190:                 console.error("Please set DROPBOX_APP_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2191:                 process.exit(1);
    2192:             }
>>> 2193:             const appSecret = process.env.DROPBOX_APP_SECRET;
    2194:             if (!appSecret) {
    2195:                 console.error("Please set DROPBOX_APP_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2196:                 process.exit(1);
    2197:             }
>>> 2198:             const refreshToken = process.env.DROPBOX_REFRESH_TOKEN;
    2199:             if (!refreshToken) {
    2200:                 console.error("Please set DROPBOX_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2272:         const client = new Graphlit();
    2273:         try {
>>> 2274:             const clientId = process.env.BOX_CLIENT_ID;
    2275:             if (!clientId) {
    2276:                 console.error("Please set BOX_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2277:                 process.exit(1);
    2278:             }
>>> 2279:             const clientSecret = process.env.BOX_CLIENT_SECRET;
    2280:             if (!clientSecret) {
    2281:                 console.error("Please set BOX_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2282:                 process.exit(1);
    2283:             }
>>> 2284:             const redirectUri = process.env.BOX_REDIRECT_URI;
    2285:             if (!redirectUri) {
    2286:                 console.error("Please set BOX_REDIRECT_URI environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2287:                 process.exit(1);
    2288:             }
>>> 2289:             const refreshToken = process.env.BOX_REFRESH_TOKEN;
    2290:             if (!refreshToken) {
    2291:                 console.error("Please set BOX_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2360:         const client = new Graphlit();
    2361:         try {
>>> 2362:             const personalAccessToken = process.env.GITHUB_PERSONAL_ACCESS_TOKEN;
    2363:             if (!personalAccessToken) {
    2364:                 console.error("Please set GITHUB_PERSONAL_ACCESS_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2431:         const client = new Graphlit();
    2432:         try {
>>> 2433:             const token = process.env.NOTION_API_KEY;
    2434:             if (!token) {
    2435:                 console.error("Please set NOTION_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2497:         const client = new Graphlit();
    2498:         try {
>>> 2499:             const clientId = process.env.MICROSOFT_TEAMS_CLIENT_ID;
    2500:             if (!clientId) {
    2501:                 console.error("Please set MICROSOFT_TEAMS_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2502:                 process.exit(1);
    2503:             }
>>> 2504:             const clientSecret = process.env.MICROSOFT_TEAMS_CLIENT_SECRET;
    2505:             if (!clientSecret) {
    2506:                 console.error("Please set MICROSOFT_TEAMS_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2507:                 process.exit(1);
    2508:             }
>>> 2509:             const refreshToken = process.env.MICROSOFT_TEAMS_REFRESH_TOKEN;
    2510:             if (!refreshToken) {
    2511:                 console.error("Please set MICROSOFT_TEAMS_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2575:         const client = new Graphlit();
    2576:         try {
>>> 2577:             const botToken = process.env.SLACK_BOT_TOKEN;
    2578:             if (!botToken) {
    2579:                 console.error("Please set SLACK_BOT_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2641:         const client = new Graphlit();
    2642:         try {
>>> 2643:             const botToken = process.env.DISCORD_BOT_TOKEN;
    2644:             if (!botToken) {
    2645:                 console.error("Please set DISCORD_BOT_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2709:         const client = new Graphlit();
    2710:         try {
>>> 2711:             const token = process.env.TWITTER_TOKEN;
    2712:             if (!token) {
    2713:                 console.error("Please set TWITTER_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2775:         const client = new Graphlit();
    2776:         try {
>>> 2777:             const token = process.env.TWITTER_TOKEN;
    2778:             if (!token) {
    2779:                 console.error("Please set TWITTER_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2897:         const client = new Graphlit();
    2898:         try {
>>> 2899:             const clientId = process.env.GOOGLE_EMAIL_CLIENT_ID;
    2900:             if (!clientId) {
    2901:                 console.error("Please set GOOGLE_EMAIL_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2902:                 process.exit(1);
    2903:             }
>>> 2904:             const clientSecret = process.env.GOOGLE_EMAIL_CLIENT_SECRET;
    2905:             if (!clientSecret) {
    2906:                 console.error("Please set GOOGLE_EMAIL_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2907:                 process.exit(1);
    2908:             }
>>> 2909:             const refreshToken = process.env.GOOGLE_EMAIL_REFRESH_TOKEN;
    2910:             if (!refreshToken) {
    2911:                 console.error("Please set GOOGLE_EMAIL_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2976:         const client = new Graphlit();
    2977:         try {
>>> 2978:             const clientId = process.env.MICROSOFT_EMAIL_CLIENT_ID;
    2979:             if (!clientId) {
    2980:                 console.error("Please set MICROSOFT_EMAIL_CLIENT_ID environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2981:                 process.exit(1);
    2982:             }
>>> 2983:             const clientSecret = process.env.MICROSOFT_EMAIL_CLIENT_SECRET;
    2984:             if (!clientSecret) {
    2985:                 console.error("Please set MICROSOFT_EMAIL_CLIENT_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    2986:                 process.exit(1);
    2987:             }
>>> 2988:             const refreshToken = process.env.MICROSOFT_EMAIL_REFRESH_TOKEN;
    2989:             if (!refreshToken) {
    2990:                 console.error("Please set MICROSOFT_EMAIL_REFRESH_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3056:         const client = new Graphlit();
    3057:         try {
>>> 3058:             const apiKey = process.env.LINEAR_API_KEY;
    3059:             if (!apiKey) {
    3060:                 console.error("Please set LINEAR_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3126:         const client = new Graphlit();
    3127:         try {
>>> 3128:             const personalAccessToken = process.env.GITHUB_PERSONAL_ACCESS_TOKEN;
    3129:             if (!personalAccessToken) {
    3130:                 console.error("Please set GITHUB_PERSONAL_ACCESS_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3196:         const client = new Graphlit();
    3197:         try {
>>> 3198:             const email = process.env.JIRA_EMAIL;
    3199:             if (!email) {
    3200:                 console.error("Please set JIRA_EMAIL environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3201:                 process.exit(1);
    3202:             }
>>> 3203:             const token = process.env.JIRA_TOKEN;
    3204:             if (!token) {
    3205:                 console.error("Please set JIRA_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3876:             .describe("Text type (Plain, Markdown, Html). Defaults to Markdown."),
    3877:     }, async ({ text, textType, channelName }) => {
>>> 3878:         const botToken = process.env.SLACK_BOT_TOKEN;
    3879:         if (!botToken) {
    3880:             console.error("Please set SLACK_BOT_TOKEN environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3917:         text: z.string().describe("Text to send."),
    3918:     }, async ({ text }) => {
>>> 3919:         const consumerKey = process.env.TWITTER_CONSUMER_API_KEY;
    3920:         if (!consumerKey) {
    3921:             console.error("Please set TWITTER_CONSUMER_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3922:             process.exit(1);
    3923:         }
>>> 3924:         const consumerSecret = process.env.TWITTER_CONSUMER_API_SECRET;
    3925:         if (!consumerSecret) {
    3926:             console.error("Please set TWITTER_CONSUMER_API_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3927:             process.exit(1);
    3928:         }
>>> 3929:         const accessTokenKey = process.env.TWITTER_ACCESS_TOKEN_KEY;
    3930:         if (!accessTokenKey) {
    3931:             console.error("Please set TWITTER_ACCESS_TOKEN_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3932:             process.exit(1);
    3933:         }
>>> 3934:         const accessTokenSecret = process.env.TWITTER_ACCESS_TOKEN_SECRET;
    3935:         if (!accessTokenSecret) {
    3936:             console.error("Please set TWITTER_ACCESS_TOKEN_SECRET environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3987:             .describe("Text type (Plain, Markdown, Html). Defaults to Markdown."),
    3988:     }, async ({ text, textType, subject, to }) => {
>>> 3989:         const from = process.env.FROM_EMAIL_ADDRESS;
    3990:         if (!from) {
    3991:             console.error("Please set FROM_EMAIL_ADDRESS environment variable.");
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: {b�!1����*'I��Ǔʗ�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �騽ਞק��k�`��W��*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: u�^��%�*%��-���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���Ȝ��(~��jky��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �x��"r�,��Sy��1�,j�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ����-���j֛jǬ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���8�r�� ���l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���j(�W�jW�u��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���(Z���{K��ڮ'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �^m�tq������W��N�s�:~t

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �^m�tq������W��N�s�:~t

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �x��"r�,��Sy��1�,j�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �x��"r�,��D���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: u��&�"f�x*'���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��� 8U��O�i

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��z{O��b���Z+��l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��z{O��b���Z+��l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: u�^��%�*%��-���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��z{O��b���Z+��l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r�ߊ �xLm��-��ҥ�"~'�*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r�ߊ �xLm��-��ҥ�"~'�*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r�ߊ �xLm��-��ҥ�"~'�*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: {b�!1����*'I��Ǔʗ�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: i�B�{^���*%��-���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �騽ਞק��k�`��W��*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �騽ਞק��k�`��W��*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    514:         var mimeType;
    515:         if (url) {
>>> 516:             const fetchResponse = await fetch(url);
    517:             if (!fetchResponse.ok) {
    518:                 throw new Error(`Failed to fetch data from ${url}: ${fetchResponse.statusText}`);
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.0 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumOB-001ObfuscationMedium ConfidenceLine 0

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    2066:     server.tool("ingestGoogleDriveFiles", `Ingests files from Google Drive into Graphlit knowledge base.
    2067:     Accepts optional Google Drive folder identifier, and an optional read limit for the number of files to ingest.
>>> 2068:     For example, with Google Drive URI (https://drive.google.com/drive/u/0/folders/32tzhRD12KDh2hXABY8OZRFv7Smy8WBkQ), the folder identifier is 32tzhRD12KDh2hXABY8OZRFv7Smy8WBkQ.
    2069:     If no folder identifier provided, ingests files from root Google Drive folder.
    2070:     Requires environment variables to be configured: GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON -or- GOOGLE_DRIVE_CLIENT_ID, GOOGLE_DRIVE_CLIENT_SECRET, GOOGLE_DRIVE_REFRESH_TOKEN.
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical116
Feb 23, 2026critical116
Feb 22, 2026critical116