codebase-memory-mcp-ui-bin
LOW
maintainer cwrau
2 votes
base
codebase-memory-mcp-bin
scanned 2026-09-17 00:27:14.276658
Why flagged
The eval is used to dynamically generate package functions from a template, which is a known AUR pattern; the content being evaluated is constructed from static, trusted variables and not from untrusted external input.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The eval is used to dynamically generate package functions from a template, which is a known AUR pattern; the content being evaluated is constructed from static, trusted variables and not from untrusted external input.
-
PKGBUILD:54
eval "$pkgfun"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer Chris Werner Rau <aur@cwrau.io>
2
3
_pkgname=codebase-memory-mcp
4
pkgbase=$_pkgname-bin
5
pkgname=($_pkgname-bin $_pkgname-ui-bin)
6
pkgver=0.10.6 # renovate: datasource=github-releases depName=DeusData/codebase-memory-mcp
7
pkgrel=1
8
pkgdesc="High-performance code intelligence MCP server with persistent knowledge graph"
9
url="https://github.com/DeusData/$_pkgname"
10
license=('MIT')
11
arch=('x86_64' 'aarch64')
12
source_x86_64=(
13
"$_pkgname-$pkgver-x86_64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-linux-amd64.tar.gz"
14
"$_pkgname-$pkgver-ui-x86_64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-ui-linux-amd64.tar.gz"
15
)
16
source_aarch64=(
17
"$_pkgname-$pkgver-aarch64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-linux-arm64.tar.gz"
18
"$_pkgname-$pkgver-ui-aarch64.tar.gz::$url/releases/download/v${pkgver}/$_pkgname-ui-linux-arm64.tar.gz"
19
)
20
sha512sums_x86_64=('3b25dbb15562f1f5fd56b7715ee61797cdec2d962a8443d2e6ceb607401b2974efa4c9d6371be5f00113f94d655c5b9a1628b6f51240ab171667c5d44268f54d'
21
'3b25dbb15562f1f5fd56b7715ee61797cdec2d962a8443d2e6ceb607401b2974efa4c9d6371be5f00113f94d655c5b9a1628b6f51240ab171667c5d44268f54d')
22
sha512sums_aarch64=('9b4acf181e61874841e1750ba0cca0ee128d2a2008855cc7592495a553efa9601810c8335b045525bd8994e16c0fdc7daafb69ece650f287ff87177787a63684'
23
'9b4acf181e61874841e1750ba0cca0ee128d2a2008855cc7592495a553efa9601810c8335b045525bd8994e16c0fdc7daafb69ece650f287ff87177787a63684')
24
noextract=(
25
"$_pkgname-$pkgver-ui-x86_64.tar.gz"
26
"$_pkgname-$pkgver-ui-aarch64.tar.gz"
27
)
28
29
prepare() {
30
mkdir -p ui
31
tar -xf "$_pkgname-$pkgver-ui-$CARCH.tar.gz" -C ui
32
}
33
34
declare -A _pkgdescs _srcdirs
35
_pkgdescs=(
36
[$_pkgname-bin]="$pkgdesc"
37
[$_pkgname-ui-bin]="$pkgdesc (with UI)"
38
)
39
_srcdirs=(
40
[$_pkgname-bin]=""
41
[$_pkgname-ui-bin]="ui/"
42
)
43
44
for _pkg in "${pkgname[@]}"; do
45
read -r -d '' pkgfun <<EOF
46
function package_${_pkg}() {
47
pkgdesc="${_pkgdescs[$_pkg]}"
48
provides=($_pkgname)
49
conflicts=($_pkgname $_pkgname-git)
50
51
install -D -m 0755 "\$srcdir/${_srcdirs[$_pkg]}$_pkgname" "\$pkgdir/usr/bin/$_pkgname"
52
}
53
EOF
54
eval "$pkgfun"
55
done
56
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 1 |
| 2026-09-16 00:03:17 | Low | 1 |
| 2026-09-15 00:25:31 | Low | 1 |
| 2026-09-14 00:27:57 | Low | 1 |
| 2026-09-13 00:19:54 | Low | 1 |
| 2026-09-12 00:25:17 | Low | 1 |
| 2026-09-11 00:19:22 | Low | 1 |
| 2026-09-10 00:22:44 | Low | 1 |
| 2026-09-09 00:04:09 | Low | 1 |
| 2026-09-08 00:18:08 | Low | 1 |
| 2026-09-07 00:30:15 | Low | 1 |
| 2026-09-06 00:17:06 | Low | 1 |
| 2026-09-05 00:16:27 | Low | 1 |
| 2026-09-04 00:03:13 | Low | 1 |
| 2026-09-03 00:15:47 | Low | 1 |
| 2026-09-02 00:02:31 | Low | 1 |
| 2026-09-01 00:11:19 | Low | 1 |
| 2026-08-31 00:19:57 | Low | 1 |
| 2026-08-30 00:04:14 | Low | 1 |
| 2026-08-29 00:29:17 | Low | 1 |