codebase-memory-mcp-bin

maintainer cwrau · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The eval is used to dynamically generate package functions from a template, which is a known AUR pattern; the content is constructed from trusted variables and does not execute untrusted code.

Triggered rules

LOW AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The eval is used to dynamically generate package functions from a template, which is a known AUR pattern; the content is constructed from trusted variables and does not execute untrusted code.

PKGBUILD:54 eval "$pkgfun"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer Chris Werner Rau <aur@cwrau.io>
    
      2
    
      3_pkgname=codebase-memory-mcp
    
      4pkgbase=$_pkgname-bin
    
      5pkgname=($_pkgname-bin $_pkgname-ui-bin)
    
      6pkgver=0.9.0 # renovate: datasource=github-releases depName=DeusData/codebase-memory-mcp
    
      7pkgrel=1
    
      8pkgdesc="High-performance code intelligence MCP server with persistent knowledge graph"
    
      9url="https://github.com/DeusData/$_pkgname"
    
      10license=('MIT')
    
      11arch=('x86_64' 'aarch64')
    
      12source_x86_64=(
    
      13    "$_pkgname-x86_64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-linux-amd64.tar.gz"
    
      14    "$_pkgname-ui-x86_64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-ui-linux-amd64.tar.gz"
    
      15)
    
      16source_aarch64=(
    
      17    "$_pkgname-aarch64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-linux-arm64.tar.gz"
    
      18    "$_pkgname-ui-aarch64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-ui-linux-arm64.tar.gz"
    
      19)
    
      20sha512sums_x86_64=('22acb6c92a8c0eaf97af6dc4f5d8d7193270048fc6e5a89c97e610751f6c506468b60547541fb454785189e72f1f746eb246e9bd1b567135acecf6fc715604a8'
    
      21                   '61bd7a52c37c55a221a0b79f3e4ef19aa6c94622428be49d68bfb943becfb7968cb49d7140add190d8812dbca3a759ca8a1c856e6fc839bb9e0d3ef381ae9195')
    
      22sha512sums_aarch64=('32b9c433242bf1ebcd5d6ca5f0c13a1e9747f5f9c14606e877eea428eee084465b39cb133e28034a46c580992e47bf2ee59bf623005fbec48eae6738cb8b05d0'
    
      23                    'ab8e2dd3f6904e4c8c518a59a9d9e7cf666ad86dabb80c107321dfed95df36f0f8d3cea09add82cdda070760a60da8bb0905f5f3ce19ad7dfe29dbbd2ff503e0')
    
      24noextract=(
    
      25    "$_pkgname-ui-x86_64.tar.gz"
    
      26    "$_pkgname-ui-aarch64.tar.gz"
    
      27)
    
      28
    
      29prepare() {
    
      30    mkdir -p ui
    
      31    tar -xf "$_pkgname-ui-$CARCH.tar.gz" -C ui
    
      32}
    
      33
    
      34declare -A _pkgdescs _srcdirs
    
      35_pkgdescs=(
    
      36    [$_pkgname-bin]="$pkgdesc"
    
      37    [$_pkgname-ui-bin]="$pkgdesc (with UI)"
    
      38)
    
      39_srcdirs=(
    
      40    [$_pkgname-bin]=""
    
      41    [$_pkgname-ui-bin]="ui/"
    
      42)
    
      43
    
      44for _pkg in "${pkgname[@]}"; do
    
      45    read -r -d '' pkgfun <<EOF
    
      46function package_${_pkg}() {
    
      47    pkgdesc="${_pkgdescs[$_pkg]}"
    
      48    provides=($_pkgname)
    
      49    conflicts=($_pkgname $_pkgname-git)
    
      50
    
      51    install -D -m 0755 "\$srcdir/${_srcdirs[$_pkg]}$_pkgname" "\$pkgdir/usr/bin/$_pkgname"
    
      52}
    
      53EOF
    
      54    eval "$pkgfun"
    
      55done
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 _pkgname=codebase-memory-mcp
 pkgbase=$_pkgname-bin
 pkgname=($_pkgname-bin $_pkgname-ui-bin)
-pkgver=0.8.1 # renovate: datasource=github-releases depName=DeusData/codebase-memory-mcp
+pkgver=0.9.0 # renovate: datasource=github-releases depName=DeusData/codebase-memory-mcp
 pkgrel=1
 pkgdesc="High-performance code intelligence MCP server with persistent knowledge graph"
 url="https://github.com/DeusData/$_pkgname"
@@ -17,10 +17,10 @@
     "$_pkgname-aarch64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-linux-arm64.tar.gz"
     "$_pkgname-ui-aarch64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-ui-linux-arm64.tar.gz"
 )
-sha512sums_x86_64=('c88aa4cb082d39e7e9b488f7e1493ddda7d6a5ea128f1455f1a388f25225c8ce71481a435e9400af1426d8e3430ff72d5f444a10b79a7d4d572d3fee78d7c419'
-                   'f8ad87760455fe82c49b482f232ec64250d94cdf7c8dd48ba66096111b86f19fe7e58771f4e9f7ad69e31994c152a0f4884aa6f0ce08326fc26a02b67fe9b2d3')
-sha512sums_aarch64=('80d2332a693239fc264c2c3519c195603e421b306d82b71fe9519e5570ffedf2e6fe8da5704915560eab4edacfa9f1d2249c7523aad580a726228322dc0f413e'
-                    'e77d056adde852a428731d9ae7ab1d137149acc776b32898494d717f239e58307a86520ba6e5f332d2cb321b4915babeae9bca78756e3ff174559f03b589662c')
+sha512sums_x86_64=('22acb6c92a8c0eaf97af6dc4f5d8d7193270048fc6e5a89c97e610751f6c506468b60547541fb454785189e72f1f746eb246e9bd1b567135acecf6fc715604a8'
+                   '61bd7a52c37c55a221a0b79f3e4ef19aa6c94622428be49d68bfb943becfb7968cb49d7140add190d8812dbca3a759ca8a1c856e6fc839bb9e0d3ef381ae9195')
+sha512sums_aarch64=('32b9c433242bf1ebcd5d6ca5f0c13a1e9747f5f9c14606e877eea428eee084465b39cb133e28034a46c580992e47bf2ee59bf623005fbec48eae6738cb8b05d0'
+                    'ab8e2dd3f6904e4c8c518a59a9d9e7cf666ad86dabb80c107321dfed95df36f0f8d3cea09add82cdda070760a60da8bb0905f5f3ce19ad7dfe29dbbd2ff503e0')
 noextract=(
     "$_pkgname-ui-x86_64.tar.gz"
     "$_pkgname-ui-aarch64.tar.gz"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	1
2026-08-02 00:16:08	LOW	1
2026-08-01 00:11:18	LOW	1
2026-07-31 00:14:10	LOW	1
2026-07-30 00:17:23	LOW	1
2026-07-29 00:25:53	LOW	1
2026-07-28 00:07:28	LOW	1
2026-07-27 09:34:56	LOW	1
2026-07-27 00:24:32	LOW	1
2026-07-26 00:07:32	LOW	1
2026-07-25 00:13:44	LOW	1
2026-07-24 00:02:28	LOW	1
2026-07-23 09:22:54	LOW	1
2026-06-18 16:11:54	CLEAN	0