things-mcp-server
v0.2.5MCP server for controlling Things on macOS
82
Total
5
Critical
75
High
2
Medium
Findings
unknownEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
172: return this.tryCreateWithDiagnostics(dbPath).adapter;
173: }
>>> 174: static tryCreateWithDiagnostics(dbPath = process.env.THINGS_DB_PATH) {
175: const explicitPath = dbPath?.trim();
176: const resolvedPath = resolveThingsDatabasePath(explicitPath);Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
11: const runner = new SafeCommandRunner();
12: const appleScriptAdapter = new AppleScriptAdapter(runner);
>>> 13: const urlSchemeAdapter = new UrlSchemeAdapter(runner, process.env.THINGS_AUTH_TOKEN);
14: const sqliteInit = SqliteReadAdapter.tryCreateWithDiagnostics();
15: const sqliteReadAdapter = sqliteInit.adapter;Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
47: roots.add(osHome);
48: }
>>> 49: const envHome = process.env.HOME?.trim();
50: if (envHome && envHome.length > 0) {
51: roots.add(envHome);Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
51: roots.add(envHome);
52: }
>>> 53: const envUser = process.env.USER?.trim();
54: if (envUser && envUser.length > 0) {
55: roots.add(join("/Users", envUser));Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
169: this.db.pragma("trusted_schema = OFF");
170: }
>>> 171: static tryCreate(dbPath = process.env.THINGS_DB_PATH) {
172: return this.tryCreateWithDiagnostics(dbPath).adapter;
173: }Dynamic code execution via exec()
Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.
592: const compactDateTimeUtc = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/;
593: const compactDateTimeLocal = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})$/;
>>> 594: const dateMatch = compactDate.exec(raw);
595: if (dateMatch) {
596: const [, year, month, day] = dateMatch;Decoded base64 content: {ki�M�fެ�Ҷ��� �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDynamic code execution via exec()
Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.
597: return `${year}-${month}-${day}`;
598: }
>>> 599: const utcDateTimeMatch = compactDateTimeUtc.exec(raw);
600: if (utcDateTimeMatch) {
601: const [, year, month, day, hour, minute, second] = utcDateTimeMatch;Dynamic code execution via exec()
Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.
602: return `${year}-${month}-${day}T${hour}:${minute}:${second}Z`;
603: }
>>> 604: const localDateTimeMatch = compactDateTimeLocal.exec(raw);
605: if (localDateTimeMatch) {
606: const [, year, month, day, hour, minute, second] = localDateTimeMatch;Decoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: u���^r��zw "w�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��z�� ����H��Z�Ǭ
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: i�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: i�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: u���^r��zw "w�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�R���� �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ�Ҷ��� �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�A��^jpr)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: u���^r��zw 2�^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�R���� �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�M�fެ �k r)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {ki�A��^jpr)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r��i�Cjד�g��ƥ
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r��i�Cjד�g��ƥ
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: u���^r��zw 2�^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���x���-������
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: u���^r��zw "w�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���jX�x���� j�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���x���-������
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��(���jZ��r!ӫ5��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��(���jZ��r!ӫ5��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��(���jZ��r!ӫ5��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��h2�b~'�*' �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��h ��zYZ�*' �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��h2�b~'�*' �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��h ��zYZ�*' �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: u���^r��zw "w�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���x���-������
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���jX�x���� j�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���jX�x���� j�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���jX�x���� j�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���jX�x���� j�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r(��^��-��)�)^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: v+ ���=�a��¢{Z�w�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: v+ ���=�a��¢{Z�w�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r(��^��-��)�)^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �����yh��8��z,�',
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �����yh��8��z,�',
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��S�� z֝jցj�!
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��S�� z֝jցj�!
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: i�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: i�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: i�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �驕�^�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: i�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �驕�^�^�*&�W����y��zw �^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��m"{-jw J֫�6�y�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �驕�^5�m"{-jw J֫�6�y�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ~V����n7��:kbzWl
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ~V����n7��:kbzWl
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �����yh��8��z,�',
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveNode.js child process spawning
Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.
>>> 1: import { spawn } from "node:child_process";
2: import { ALLOWED_COMMANDS, DEFAULT_TIMEOUT_MS } from "../constants.js";
3: import { SecurityError, ThingsOperationError } from "../errors.js";Decoded base64 content: N��éz����Į�+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.5 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveScan History
| Date | Risk | Findings | Files | Duration |
|---|---|---|---|---|
| Feb 23, 2026 | critical | 82 | 21 | 0.00s |
| Feb 22, 2026 | critical | 82 | 21 | 0.00s |