Hi from Anthropic 👋
We reviewed Alaya for inclusion in the Anthropic MCP Directory. We found several items that need to be addressed before we can list the server.
Required
-
Server startup failure — We observed the server fails to start due to a binary permission error. The launch script resolves the binary path without verifying execute permissions. Please ensure the binary has correct permissions after installation across all deployment environments.
-
Install script security — We observed the postinstall script uses shell command string interpolation to download binaries. Please use parameterized execution (e.g., execFileSync with argument arrays) instead of template literal interpolation in shell commands.
-
Binary integrity verification — We observed binaries are downloaded from GitHub releases without checksum or signature verification. Please add SHA256 verification after download to protect against supply chain attacks.
Recommended
-
Architecture disclosure — The manifest describes this as a Node.js server, but the actual implementation is a wrapper around compiled Rust binaries. Please update the manifest description and documentation to reflect the binary wrapper architecture.
-
Telemetry disclosure — We observed install analytics that are more active than what the README describes. Please document the structured telemetry reporting and opt-out mechanisms in the README.
-
Error messages — We observed generic error messages for binary execution failures. Consider adding platform-specific troubleshooting guidance for common issues like permission errors.
We're happy to re-review once these are addressed. Feel free to reach out with any questions.
Hi from Anthropic 👋
We reviewed
Alayafor inclusion in the Anthropic MCP Directory. We found several items that need to be addressed before we can list the server.Required
Server startup failure — We observed the server fails to start due to a binary permission error. The launch script resolves the binary path without verifying execute permissions. Please ensure the binary has correct permissions after installation across all deployment environments.
Install script security — We observed the postinstall script uses shell command string interpolation to download binaries. Please use parameterized execution (e.g.,
execFileSyncwith argument arrays) instead of template literal interpolation in shell commands.Binary integrity verification — We observed binaries are downloaded from GitHub releases without checksum or signature verification. Please add SHA256 verification after download to protect against supply chain attacks.
Recommended
Architecture disclosure — The manifest describes this as a Node.js server, but the actual implementation is a wrapper around compiled Rust binaries. Please update the manifest description and documentation to reflect the binary wrapper architecture.
Telemetry disclosure — We observed install analytics that are more active than what the README describes. Please document the structured telemetry reporting and opt-out mechanisms in the README.
Error messages — We observed generic error messages for binary execution failures. Consider adding platform-specific troubleshooting guidance for common issues like permission errors.
We're happy to re-review once these are addressed. Feel free to reach out with any questions.