Skip to content
Open-Source Registry

cargo / assura-mcp / 0.7.0

assura-mcp 0.7.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
303
operations
55K
packages
269
compiler runs
118
connections
4
job time
2m 05s
capture
706 KB
records
98K
bytes / record
7.2

Build behaviourfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run cf701bc9-5d79-4a1b-a486-1504446fd579 · built 2026-10-15 · complete

Graph

egress · medium · in libassura_mcp.rlib
3

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Build script reached api.github.com +2
    z3-sys 0.13.1 › api.github.com:443, github.com:443, release-assets.githubusercontent.com:443
    medium
  • Prebuilt library downloaded by a build script from its documented source
    libz3.a › api.github.com, github.com, release-assets.githubusercontent.com
    medium

Detection

mediumwitnessed

Build script reached api.github.com +2

Unexpected network connection

Subject
z3-sys 0.13.1
Destination
api.github.com:443, github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to api.github.com:443, opened by build_script_build-0fe0385edfdce07f

    subject api.github.com:443

    by /home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-0fe0385edfdce07f

    subject github.com:443

    by /home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build

  3. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-0fe0385edfdce07f

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build

  4. What a build script's fetch becamesupport

    46 files came down; the build compiled or linked libz3.a

  5. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build_script_build-0fe0385edfdce07f

  6. Build script fetched what its crate documents it fetchessupport

    z3-sys's build script fetches a prebuilt Z3 from api.github.com, github.com, release-assets.githubusercontent.com: z3-sys's build.rs fetches a Z3 release from Z3Prover's GitHub releases (observed on the registry, 2026-10-06)

In libassura_mcp.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2480
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2480
  3. build-script-build/home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build4951

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Detection

mediumwitnessed

Prebuilt library downloaded by a build script from its documented source

Object file origin needs review

Subject
/home/runner/work/assura/assura/target/release/build/z3-sys-ad7d5927aebd0ef9/out/z3-5.1.0/bin/libz3.awritten by build_script_build-0fe0385edfdce07f
Destination
api.github.com, github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · assura

Witness chain

  1. /home/runner/work/assura/assura/target/release/build/z3-sys-ad7d5927aebd0ef9/out/z3-5.1.0/bin/libz3.avia /home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build
    • Object written under a build script that downloadedfrom api.github.com · github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build_script_build-0fe0385edfdce07f, which downloaded from api.github.com, github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-0fe0385edfdce07f from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      z3-sys asked the linker for it: static z3 (target/release/build/z3-sys-ad7d5927aebd0ef9/output)

    source
  2. dependency
    artifact

Evidence

  1. Build script fetched what its crate documents it fetchessupport

    z3-sys's build script fetches a prebuilt Z3 from api.github.com, github.com, release-assets.githubusercontent.com: z3-sys's build.rs fetches a Z3 release from Z3Prover's GitHub releases (observed on the registry, 2026-10-06)

In libassura_mcp.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2480
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2480
  3. build-script-build/home/runner/work/assura/assura/target/release/build/z3-sys-0fe0385edfdce07f/build-script-build4951

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

4 peers
  • api.github.com:443 build code of z3-sys · build_script_build-0fe0385edfdce07f · GitHub, Inc. · 46 files · went into an output documented
  • github.com:443 build code of z3-sys · build_script_build-0fe0385edfdce07f · GitHub, Inc. · 46 files · went into an output documented
  • release-assets.githubusercontent.com:443 build code of z3-sys · build_script_build-0fe0385edfdce07f · Fastly, Inc. · 46 files · went into an output documented
  • static.crates.io:8080 the package manager · cargo (assura) via crates.io · 14,923 files · went into an output ecosystem
Dependencies290Build behaviour
adler22.0.1
aes0.9.1
aho-corasick1.1.4
android_system_properties0.1.5
anyhow1.0.103build script, not run
ariadne0.6.0
assura-ast0.7.0
assura-codegen0.7.0
assura-config0.7.0
assura-diagnostics0.7.0
assura-parser0.7.0
assura-pipeline0.7.0
assura-resolve0.7.0
assura-rust-analyzer0.7.0
assura-smt0.7.0
assura-stdlib0.7.0
assura-types0.7.0
atomic-waker1.1.2
autocfg1.5.1
base640.22.1
base640.23.0
bitflags2.13.0
block-buffer0.12.1
bumpalo3.20.3
bytes1.11.1
bzip20.6.1
cc1.2.64
cfg-if1.0.4
cfg_aliases0.2.1
chacha200.10.2
chrono0.4.45
cipher0.5.2
cmov0.5.4
const-oid0.10.2
constant_time_eq0.4.2
core-foundation-sys0.8.7
countme3.0.1
cpubits0.1.1
cpufeatures0.3.0
crc32fast1.5.0build script
crossbeam-deque0.8.6
crossbeam-epoch0.9.20build script
crossbeam-utils0.8.21build script
crypto-common0.2.2
ctutils0.4.2
darling0.24.0
darling_core0.24.0
darling_macro0.24.0proc macro
deflate640.1.12
deranged0.5.8
digest0.11.3
displaydoc0.2.6proc macro
dyn-clone1.0.20
either1.16.0
equivalent1.0.2
find-msvc-tools0.1.9
flate21.1.9
fnv1.0.7
foldhash0.1.5
form_urlencoded1.2.2
futures0.3.32
futures-channel0.3.32
futures-core0.3.32
futures-executor0.3.32
futures-io0.3.32
futures-macro0.3.32proc macro
futures-sink0.3.32
futures-task0.3.32
futures-util0.3.32
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.2build script
hashbrown0.14.5
hashbrown0.15.5
hashbrown0.17.1
heck0.5.0
hmac0.13.0
http1.5.0
http-body1.0.1
http-body-util0.1.3
httparse1.10.1build script
hybrid-array0.4.12
hyper1.10.1
hyper-rustls0.27.9
hyper-util0.1.20
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
id-arena2.3.0
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
indexmap2.14.0
inout0.2.2
ipnet2.12.0
itoa1.0.18
jobserver0.1.34
js-sys0.3.102
ld-linux-x86-64.so.2system library
leb128fmt0.1.0
libbz2-rs-sys0.2.5
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
litemap0.8.2
log0.4.32
logos0.16.1
logos-codegen0.16.1
logos-derive0.16.1proc macro
lru-slab0.1.2
lzma-rust20.16.4
memchr2.8.2
memoffset0.9.1build script
miniz_oxide0.8.9
mio1.2.1
num-conv0.2.2
num-traits0.2.19build script
once_cell1.21.4
pastey0.2.3proc macro
pbkdf20.13.0
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.33
potential_utf0.1.5
powerfmt0.2.0
ppmd-rust1.4.0
prettyplease0.2.37build script
prettyplease0.3.0build script
proc-macro21.0.107build script
quinn0.11.12build script, not run
quinn-proto0.11.19
quinn-udp0.5.14build script, not run
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
rand0.10.3
rand_core0.10.1
rand_pcg0.10.2
rayon1.12.0
rayon-core1.13.0build script
ref-cast1.0.25build script
ref-cast-impl1.0.25proc macro
regex-automata0.4.14
regex-syntax0.8.11
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rmcp3.5.1build script
rmcp-macros3.5.1proc macro
rowan0.17.0
rustc-hash1.1.0
rustc-hash2.1.2
rustls0.23.46build script
rustls-pki-types1.14.1
rustls-webpki0.103.15
rustversion1.0.22build script, not runproc macro
ryu1.0.23
schemars1.2.3
schemars_derive1.2.3proc macro
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_derive_internals0.30.0
serde_json1.0.154build script
serde_spanned1.1.2
serde_urlencoded0.7.1
sha10.11.0
sha20.11.1
shlex2.0.1
simd-adler320.3.9
slab0.4.12
smallvec1.15.2
socket20.6.4
stable_deref_trait1.2.1
strsim0.11.1
subtle2.6.1
syn2.0.119
syn3.0.9
sync_wrapper1.0.2
synstructure0.13.2
text-size1.1.1
thiserror2.0.21build script
thiserror-impl2.0.21proc macro
time0.3.51
time-core0.1.9
tinystr0.8.3
tinyvec1.11.0
tinyvec_macros0.1.1
tokio1.53.3
tokio-macros2.7.0proc macro
tokio-rustls0.26.4
tokio-util0.7.18
toml1.1.8+spec-1.1.0
toml_datetime1.1.2+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
toml_writer1.1.3+spec-1.1.0
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
typed-path0.12.3
typenum1.20.1
unicode-ident1.0.24
unicode-width0.2.2
unicode-xid0.2.6
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
uuid1.24.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasip30.4.0+wasi-0.3.0-rc-2026-01-06
wasm-bindgen0.2.125build script, not run
wasm-bindgen-futures0.4.75
wasm-bindgen-macro0.2.125proc macro
wasm-bindgen-macro-support0.2.125
wasm-bindgen-shared0.2.125build script, not run
wasm-encoder0.244.0
wasm-metadata0.244.0
wasmparser0.244.0
web-sys0.3.102
web-time1.1.0
webpki-roots1.0.8
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.52.6
windows-targets0.53.5
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
winnow1.0.3
wit-bindgen0.51.0build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
wit-bindgen-core0.51.0
wit-bindgen-rust0.51.0build script, not run
wit-bindgen-rust-macro0.51.0build script, not runproc macro
wit-component0.244.0
wit-parser0.244.0
writeable0.6.3
yansi1.0.1
yoke0.8.3
yoke-derive0.8.2proc macro
z30.21.1build script
z3-sys0.13.1build scriptnetworkapi.github.com, github.com, release-assets.githubusercontent.com
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
zip8.6.0
zlib-rs0.6.4
zmij1.0.21build script
zopfli0.8.3
zstd0.13.3
zstd-safe7.2.4build script
zstd-sys2.0.16+zstd.1.5.7build script

Raw data

capture
706 KB
records
97,761
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-15 · run cf701bc9-5d79-4a1b-a486-1504446fd579

analysis 0.1.0 · 2026-10-15 · 20a5b2e · graph v2