exa-mcp-server

maintainer lapsus · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Package builds from an official npm registry source, installs prebuilt JavaScript files and binaries; no remote code execution or exfiltration observed, but limited votes and recent upload warrant caution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from an official npm registry source, installs prebuilt JavaScript files and binaries; no remote code execution or exfiltration observed, but limited votes and recent upload warrant caution.

PKGBUILD

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=exa-mcp-server
    
      4pkgver=3.4.0
    
      5pkgrel=1
    
      6pkgdesc="MCP server exposing Exa web search and web crawling tools"
    
      7arch=('any')
    
      8url="https://exa.ai/docs/reference/exa-mcp"
    
      9license=('MIT')
    
      10depends=('nodejs')
    
      11source=("https://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz")
    
      12sha256sums=('cbc24567086756cde087eee8d8f617b7c423b1761e068e2b52e167b013e63f19')
    
      13
    
      14latestver() {
    
      15    curl -fsSL "https://registry.npmjs.org/${pkgname}/latest" | jq -r '.version'
    
      16}
    
      17
    
      18package() {
    
      19    cd "${srcdir}/package"
    
      20
    
      21    # Self-contained esbuild bundle shipped prebuilt in the npm tarball
    
      22    install -dm755 "${pkgdir}/usr/lib/${pkgname}"
    
      23    cp -a dist skills "${pkgdir}/usr/lib/${pkgname}/"
    
      24    install -Dm644 package.json "${pkgdir}/usr/lib/${pkgname}/package.json"
    
      25    install -Dm644 README.md "${pkgdir}/usr/lib/${pkgname}/README.md"
    
      26
    
      27    # Normalize permissions of upstream data files (cp preserves 0755 from tarball)
    
      28    find "${pkgdir}/usr/lib/${pkgname}" -type f ! -name 'stdio.cjs' -exec chmod 644 {} +
    
      29
    
      30    install -d "${pkgdir}/usr/bin"
    
      31    ln -s "/usr/lib/${pkgname}/dist/stdio.cjs" "${pkgdir}/usr/bin/${pkgname}"
    
      32
    
      33    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 19:21:46	LOW	2