swastiksingh-dev/Aura-Components-MCP

Review signals: 1 connection review, 2 hardcoded secret.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 7 distinct locations. 14 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 2 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Free-only catalogue: search results default to free rows: Real input produced the expected result: Hero Section with Services, CTA, and Project Gallery

  Source: Everything defaults to free. Pro rows never sneak into results.

  Input: {"tool": "aura_search_components", "arguments": {"query": "pricing", "limit": 2}}

  Expected: free component rows returned

  Command: node ./dist/server.js tools/call {"tool": "aura_search_components", "arguments": {"query": "pricing", "limit": 2}}

  Observed: Hero Section with Services, CTA, and Project Gallery\",\n \"description\": \"Dark-themed hero banner for agency sites featuring headline, service pricing, dual CTAs, and a responsive project gallery inside a faux browser frame. Uses Tailwind CSS, gradients, and blur effects for a modern, interactive landing experience.\",\n \"tags\": [\n \"hero\",\n \"landing\",\n \"tailwind\",\n \"responsive\",\n \"gallery\",\n \"agency\",\n \"cta\",\n \"dark\",\n \"section\"\n ],\n \"premium\": false,\n \"views\": 1897,\n

• No login: catalogue search works without credentials: Real input produced the expected result: Hero Section with Services, CTA, and Project Gallery

  Source: There is no auth in this server. No OAuth, no API key to paste, no account to create.

  Input: {"tool": "aura_search_components", "arguments": {"query": "pricing", "limit": 2}}

  Expected: component search results with no key

  Command: node ./dist/server.js tools/call {"tool": "aura_search_components", "arguments": {"query": "pricing", "limit": 2}}

  Observed: Hero Section with Services, CTA, and Project Gallery\",\n \"description\": \"Dark-themed hero banner for agency sites featuring headline, service pricing, dual CTAs, and a responsive project gallery inside a faux browser frame. Uses Tailwind CSS, gradients, and blur effects for a modern, interactive landing experience.\",\n \"tags\": [\n \"hero\",\n \"landing\",\n \"tailwind\",\n \"responsive\",\n \"gallery\",\n \"agency\",\n \"cta\",\n \"dark\",\n \"section\"\n ],\n \"premium\": false,\n \"views\": 1897,\n

Examples

• Hermetic test suite passes with no network: command completed successfully

  Source: README.md Develop section (npm test)

  Input: npm test

  Expected: 275 tests pass, 0 fail

  Command: npm test

  Observed: ls/list exposes 29 tools incl. aura_version --- duration_ms: 1.861439 type: 'test' ... # Subtest: aura_version handler returns verdict; unwired backend errors ok 274 - aura_version handler returns verdict; unwired backend errors --- duration_ms: 0.271085 type: 'test' ... # Subtest: aura_status carries update block but never fails without backend ok 275 - aura_status carries update block but never fails without backend --- duration_ms: 0.364483 type: 'test' ... 1..275 # tests 275 # suites 0 # pass 275 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 10024.815711

• Live checks against the real catalogue pass: command completed successfully

  Source: README.md Develop section (npm run verify)

  Input: npm run verify

  Expected: 45 live checks pass, 0 fail

  Command: npm run verify

  Observed: PASS award_search bad mode -> -32602 PASS award_index status shape PASS award_index bad watch kind -> -32602 PASS motion search shape (emptyCorpus or hits) PASS blueprint ref-count guard -> -32602 PASS scaffold survives #()," in goal (PGRST100 repro) VERIFY pass=45 fail=0 ms=18450 <<< aura-components-mcp >>> free Aura catalogue, every AI agent starting your aura for designing... warming catalogue cache... catalogue credit: Aura (aura.build) — components, skills, assets, systems built by swastiksingh-dev — free to use, MIT, no paywall aura-components-mcp v1.7.3 running — 35 tools on stdio

Local or hosted: both

Start the Aura Components MCP stdio server from source and call aura_search_components over MCP to get live free component results

cd <guest-path> && pwd && ls -la && id -u && python3 --version && git --version; cat README.md 2>/dev/null | head -200
ls -la /inputs 2>/dev/null; ls <guest-path> 2>/dev/null; cd <guest-path> && git status 2>&1 | head -3
cd <guest-path> && (node -v; npm -v) 2>&1; grep -n "^## \|^### " README.md | head -80; echo ---; sed -n '/^## Develop/,/^## Credits/p' README.md | head -80; echo ---; cat package.json; ls scripts test dist examples
cd <guest-path> && git init -q && git remote add origin https://github.com/swastiksingh-dev/Aura-Components-MCP && timeout 120 git fetch --depth 1 origin deebc7299ce37855769fae501310fef9ee3c3fe9 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head; echo ---; env | grep -i proxy; apt-cache policy nodejs 2>/dev/null | head -3; cat /etc/os-release | head -2
sudo -n true && echo SUDO_OK; (timeout 60 curl -sI https://nodejs.org/dist/latest-v22.x/ | head -1) ; (timeout 60 curl -sI https://deb.nodesource.com/ | head -1); echo rc=$?
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 120 curl -fsSL https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt | grep 'linux-x64.tar.xz' ; 
set -e; mkdir -p /tmp/nodedl && cd /tmp/nodedl && timeout 300 curl -fsSLO https://nodejs.org/dist/latest-v22.x/node-v22.23.4-linux-x64.tar.xz && timeout 60 curl -fsSL https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt -o SHASUMS256.txt && grep ' node-v22.23.4-linux-x64.tar.xz$' SHASUMS256.txt | sha256sum -c - && sudo mkdir -p /opt/node22 && sudo tar -xJf node-v22.23.4-linux-x64.tar.xz -C /opt/node22 --strip-components=1 && /opt/node22/bin/node -v && /opt/node22/bin/npm -v
export PATH=/opt/node22/bin:$PATH && cd <guest-path> && node -v && npm -v && npm install 2>&1 | tail -5 && npm run build 2>&1 | tail -5 && ls -la dist && git status --short
cd <guest-path> && sed -n 203,215p README.md; echo ....; sed -n 279,365p README.md
export PATH=/opt/node22/bin:$PATH && cd <guest-path> && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"0"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"aura_search_components","arguments":{"query":"pricing","limit":2}}}' | timeout 60 node ./dist/server.js | cut -c1-1500
export PATH=/opt/node22/bin:$PATH && cd <guest-path> && ( printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"0"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"aura_search_components","arguments":{"query":"pricing","limit":2}}}'; sleep 25 ) | timeout 60 node ./dist/server.js 2>/tmp/err.txt | cut -c1-1200; echo rc=$?; head -c 600 /tmp/err.txt
export PATH=/opt/node22/bin:$PATH && cd <guest-path> && timeout 900 npm test 2>&1 | tail -12; echo ---; grep -rn "setInterval\|cron\|--once\|--now\|schedule\|webhook" src scripts dist/cli.cjs README.md | cut -c1-220 | head -30
export PATH=/opt/node22/bin:$PATH && cd <guest-path> && cat dist/cli.cjs; echo; grep -rn "hour\|3600\|60 \* 60" src/*.mjs | cut -c1-200 | head; echo ---; timeout 900 npm run verify 2>&1 | tail -15; echo rc=$?
cd <guest-path> && mkdir -p .coldpass && export PATH=/opt/node22/bin:$PATH && for q in "Everything defaults to free. Pro rows never sneak into results." "There is no auth in this server. No OAuth, no API key to paste, no account to create." "Needs Node 22 or newer. No other dependency. Pick one:" ; do grep -cF "$q" README.md; done
cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","./dist/server.js"],"cwd":"<guest-path>","env":{"PATH":"/opt/node22/bin:/usr/local/bin:/usr/bin:/bin"},"tool":"aura_search_components","arguments":{"query":"pricing","limit":2},"expected_text":"Hero Section with Services, CTA, and Project Gallery"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"Free-only catalogue: search results default to free rows","source":"Everything defaults to free. Pro rows never sneak into results.","input":"query pricing, limit 2","expected":"free component rows returned","probe_kind":"mcp","argv":["node","./dist/server.js"],"tool":"aura_search_components","arguments":{"query":"pricing","limit":2},"expected_text":"Hero Section with Services, CTA, and Project Gallery","env":{"PATH":"/opt/node22/bin:/usr/local/bin:/usr/bin:/bin"},"cwd":"<guest-path>"},
{"kind":"claim","claim":"No login: catalogue search works without credentials","source":"There is no auth in this server. No OAuth, no API key to paste, no account to create.","input":"query pricing, limit 2, no headers","expected":"component search results with no key","probe_kind":"mcp","argv":["node","./dist/server.js"],"tool":"aura_search_components","arguments":{"query":"pricing","limit":2},"expected_text":"Hero Section with Services, CTA, and Project Gallery","env":{"PATH":"/opt/node22/bin:/usr/local/bin:/usr/bin:/bin"},"cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Hermetic test suite passes with no network","source":"README.md Develop section (npm test)","input":"npm test","expected":"275 tests pass, 0 fail","argv":["npm","test"],"cwd":"<guest-path>","env":{"PATH":"/opt/node22/bin:/usr/local/bin:/usr/bin:/bin"},"expected_text":"# fail 0"},
{"kind":"example","claim":"Live checks against the real catalogue pass","source":"README.md Develop section (npm run verify)","input":"npm run verify","expected":"45 live checks pass, 0 fail","argv":["npm","run","verify"],"cwd":"<guest-path>","env":{"PATH":"/opt/node22/bin:/usr/local/bin:/usr/bin:/bin"},"expected_text":"VERIFY pass=45 fail=0"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected package.json scripts (build/start/test/verify), dist/cli.cjs (requires server.js only), src/server.mjs stdio wiring and src/*.mjs. No cron, --once, --now, webhook or scheduler exists. The only setInterval is a browser-wait poll in src/browser-cdp.mjs. The hourly npm version check in src/version.mjs is a lazy TTL cache refreshed when a tool is called, not a product cycle.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done
export PATH=/opt/node22/bin:$PATH && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd <guest-path> && (pgrep -af "dist/server.js" || echo "no server processes left"); mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Start the Aura Components MCP stdio server from source and call aura_search_components over MCP to get live free component results","operation_scope":"Linux Ubuntu 24.04 guest, Node 22.23.4 installed to /opt/node22 (README requires Node >=22), network access to the public Aura catalogue; no credentials, no browser, no telemetry. Verified by npm test (275/275), npm run verify (45/45 live checks), and the checker replay.","steps":["git init; git remote add origin https://github.com/swastiksingh-dev/Aura-Components-MCP; git fetch --depth 1 origin deebc7299ce37855769fae501310fef9ee3c3fe9; git reset --mixed FETCH_HEAD","Install Node 22: downloaded node-v22.23.4-linux-x64.tar.xz from nodejs.org, verified SHA-256 against SHASUMS256.txt, extracted to /opt/node22 (sudo)","npm install","npm run build","node ./dist/server.js (MCP stdio; initialize then tools/call aura_search_components {\"query\":\"pricing\",\"limit\":2})","npm test","npm run verify"],"deviations":["Guest had no node/npm; Ubuntu apt nodejs is too old for README's Node >=22, so Node 22.23.4 was installed from the official nodejs.org tarball instead of the apt package. No README installer exists, so no curl|sh was run.","npm install created an untracked package-lock.json in the checkout (not in the pinned commit)","First manual stdio attempt closed stdin before the async search reply; re-run held stdin open for 25s and got the result. Not a product fault.","No browser used; browser-based features (CDP) were not exercised."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this run. Optional: commit package-lock.json or add it to .gitignore; the stdio server closes replies if stdin ends early, so clients should keep stdin open until the reply arrives."}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo report ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay >/tmp/final.txt 2>&1; echo rc=$?; python3 -I -c "import json;d=json.load(open('/tmp/final.txt')) if False else None" ; head -c 200 /tmp/final.txt