live · scanning repos
Scanrepo
github.com
github.com / Mitanshp5

Mitanshp5/Google-Flow_MCP

JavaScript·225 files·commit 49e34e4·scanned 11h ago·cached ✓
50/100
SUSPICIOUS
Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.
verdict accurate?
CLI tool detected
threat-state: suspiciouslive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

  1. when runscripts/start-browser.sh and src/utils/platform.js reference browser profile paths, where saved logins and cookies live. scripts/start-browser.sh, src/utils/platform.js
  2. otherconfig/flow.config.example.json references browser profile paths, where saved logins and cookies live. config/flow.config.example.json
warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).scripts/start-mcp.bat
:: Check CDP port
curl -s "http://localhost:9222/json/version" >nul 2>&1
if !errorlevel! NEQ 0 (
    call :log "WARN" "CDP port 9222 not responding — Chrome might not be running."
+5
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.tests/w03-behavioral.test.js
          // Simulate pre-repair probe.evaluate((b)=>{ if(selectedStateOf(b)) ... })
          const fn = new Function('b', 'return selectedStateOf(b)');
          fn(document.body);
          return ...
+5
criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/utils/platform.js. This means the suspicious code can execute when the app runs.+8
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.config/flow.config.example.json
  "chromeProfile": "Default",
  "chromeUserDataDir": "C:/Users/<username>/AppData/Local/Google/Chrome/User Data",
  "_chromeUserDataDir_macos": "/Users/<username>/Library/Application Support/Google/Ch...
+10
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.scripts/start-browser.sh
  done
  USER_DATA_DIR="$HOME/Library/Application Support/Google/Chrome"
else
  # Linux/Unix defaults
+10
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src/utils/platform.js
      path.join(programFilesX86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
      path.join(localAppData, 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]);
  }
+10
infoSuspicious file in repoExecutable file (register.ps1) in repositoryscripts/register.ps1+2
infoSuspicious file in repoExecutable file (start-browser.ps1) in repositoryscripts/start-browser.ps1+2
infoSuspicious file in repoExecutable file (start-mcp.bat) in repositoryscripts/start-mcp.bat+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

210 files scanned @ 49e34e4 | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution20
network & exfiltration0
file system access20
obfuscation0
supply chain10
owasp / injection0
telemetry
files 210/225rules hit 10engine v10commit 49e34e4

github

Mitanshp5/Google-Flow_MCP

A cross-platform MCP server for Google Flow. Automate image and video generation securely via Chrome CDP without sharing your Google credentials.

JavaScript
16
5
137d
225 files
210 scanned(93%)
49e34e4

network indicators░▒▓

Hosts this code names or would connect to. 46 found, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (1) flagged (2) pkg (14)
215 nodes · 804 edgesscroll to zoom · click node to jump to finding