alpsei/aseprite-lua-mcp

Review signals: 6 known vulnerability.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 6 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The documentation tool returns an Aseprite Lua API cheat sheet.: Real input produced the expected result: # Aseprite Lua API cheat sheet

  Source: Returns a compact cheat sheet of the Aseprite Lua API (Sprite, Layer, Cel, Image, Color, Palette, `saveCopyAs`) so the agent doesn't need to guess.

  Input: {"tool": "get_aseprite_lua_docs", "arguments": {}}

  Expected: # Aseprite Lua API cheat sheet

  Command: node dist/index.js tools/call {"tool": "get_aseprite_lua_docs", "arguments": {}}

  Observed: # Aseprite Lua API cheat sheet (run with: aseprite --batch --script file.lua)\n\n## Globals\napp.sprite -- active sprite (nil in batch unless you open/create one)\napp.activeLayer / app.activeFrame / app.activeCel\napp.params -- script params (--script-param key=value)\nprint(...) -- goes to stdout\nRect(x,y,w,h) Point(x,y) Size(w,h)\nColor{ r=255, g=0, b=0, a=255 } or Color(255,0,0,255) or Color{ gray=128 }\napp.pixelColor.rgba(r,g,b,a) -- integer pixel value (RGB mode)\n\n## Sprite\nlocal spr = Sprite(width, height) -- new RGB sprite (also: S

Examples

• Build the documented development entrypoint: command completed successfully

  Source: README.md / Development

  Input: npm install && npm run build

  Expected: TypeScript build completes

  Command: npm run build

  Observed: > [email protected] build > tsc

Local or hosted: local

MCP initialization and get_aseprite_lua_docs tool call

pwd; vault-search 'aseprite lua mcp repository quickstart operation' 2>&1; cat <host-path> 2>&1; rg --files -g 'README*' -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g 'Cargo.toml' -g 'go.mod' -g '*.md' | head -80; git status --short --branch; git rev-parse --show-toplevel; rg -n "" README.md | head -240
ls -la; find .. -name AGENTS.md -o -name README.md; find . -maxdepth 2 -type f | head -100
cat README.md; cat package.json; cat .claude/mcp.json; python3 --version; node --version 2>&1; npm --version 2>&1; id -u; sudo -n true; echo sudo_status:$?
sudo apt-get -o DPkg::Lock::Timeout=300 update && sudo apt-get -o DPkg::Lock::Timeout=300 install -y nodejs npm
npm install && npm run build
node --version; npm --version; command -v aseprite || true; apt-cache policy aseprite; find .coldpass -maxdepth 2 -type f -print; sed -n '1,240p' src/index.ts; sed -n '1,240p' src/aseprite.ts
node -e 'const {spawn}=require("node:child_process"); const p=spawn("node",["dist/index.js"],{cwd:"<guest-path>",stdio:["pipe","pipe","inherit"]}); let b=""; p.stdout.on("data",d=>{b+=d; while(b.includes("\n")){let i=b.indexOf("\n"),l=b.slice(0,i);b=b.slice(i+1);if(!l)continue;let n=JSON.parse(l);if(n.id===2){console.log(JSON.stringify(n));p.kill();}}}); p.stdin.write(JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:"2024-11-05",capabilities:{},clientInfo:{name:"coldpass-probe",version:"1"}}})+"\n"); setTimeout(()=>{p.stdin.write(JSON.stringify({jsonrpc:"2.0",method:"notifications/initialized"})+"\n");p.stdin.write(JSON.stringify({jsonrpc:"2.0",id:2,method:"tools/call",params:{name:"get_aseprite_lua_docs",arguments:{}}})+"\n");},100); setTimeout(()=>p.kill(),5000);'
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","dist/index.js"],"cwd":"<guest-path>","tool":"get_aseprite_lua_docs","arguments":{},"expected_text":"# Aseprite Lua API cheat sheet"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The documentation tool returns an Aseprite Lua API cheat sheet.","source":"Returns a compact cheat sheet of the Aseprite Lua API (Sprite, Layer, Cel, Image, Color, Palette, `saveCopyAs`) so the agent doesn't need to guess.","input":"get_aseprite_lua_docs with empty arguments","expected":"# Aseprite Lua API cheat sheet","probe_kind":"mcp","argv":["node","dist/index.js"],"tool":"get_aseprite_lua_docs","arguments":{},"expected_text":"# Aseprite Lua API cheat sheet","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Build the documented development entrypoint","source":"README.md / Development","input":"npm install && npm run build","expected":"TypeScript build completes","argv":["npm","run","build"],"cwd":"<guest-path>","expected_text":"tsc"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README command entrypoints and src/index.ts: the program serves MCP tool calls on stdio and contains no cron, timer, loop, webhook, or one-shot cycle scheduler." ,"checks":[]}
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"MCP initialization and get_aseprite_lua_docs tool call","operation_scope":"Node.js 18.19.1 stdio server, with documentation result replayed; README's Aseprite-dependent script execution could not be exercised because Aseprite is not installed and unavailable through the guest apt package index.","steps":["Read README Quick start and Development sections.","Installed Node.js and npm with sudo apt-get -o DPkg::Lock::Timeout=300 install -y nodejs npm; versions are 18.19.1 and 9.2.0.","Ran npm install and npm run build successfully.","Started documented server entrypoint node dist/index.js and called get_aseprite_lua_docs using MCP initialize and tools/call.","Saved and replayed a README claim and MCP probe; checker validation and replay passed."],"deviations":["Aseprite required for execute_aseprite_script is not installed; command -v aseprite found none and apt-cache policy aseprite returned no package. Therefore script execution and sprite output remain unverified."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF