Skip to content
Open-Source Registry

cargo / renso-code-graph-mcp / 2.0.1

renso-code-graph-mcp 2.0.1

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnshigh
processes
261
operations
20K
packages
103
compiler runs
168
connections
3
job time
24s
capture
246 KB
records
34K
bytes / record
7.1

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 5295529e-3298-4f38-b14b-f1211e43d895 · built 2026-10-16 · complete View on crates.io

Graph

egress · high · in code_graph_mcp
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain▲✓✓✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    renso-code-graph-mcp 2.0.1 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Downloaded file compiled into the artifact
    embedded_binary › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
renso-code-graph-mcp 2.0.1
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
code_graph_mcp-94cac18d8f063f34build
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-48d234ab88b13491

    subject github.com:443

    by /home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-48d234ab88b13491

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build-script-build

  3. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked embedded_binary

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build_script_build-48d234ab88b13491

In code_graph_mcp

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2448
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2448
  3. build-script-build/home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build-script-build3558

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-e66fcc557c6f1912/out/embedded_binarywritten by build_script_build-48d234ab88b13491
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · code-graph-dist

Witness chain

  1. /home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-e66fcc557c6f1912/out/embedded_binaryvia /home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build_script_build-48d234ab88b13491, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-48d234ab88b13491 from a network connection without a recorded source compilation

    source
  2. code_graph_mcp-94cac18d8f063f34member
    artifact

Evidence

  • written under the build script at /home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build_script_build-48d234ab88b13491, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-48d234ab88b13491 from a network connection without a recorded source compilation

In code_graph_mcp

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2448
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2448
  3. build-script-build/home/runner/work/code-graph-dist/code-graph-dist/target/release/build/renso-code-graph-mcp-48d234ab88b13491/build-script-build3558

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 renso-code-graph-mcp's own build code · build_script_build-48d234ab88b13491 · GitHub, Inc. · 1 file · went into an output undeclared
  • release-assets.githubusercontent.com:443 renso-code-graph-mcp's own build code · build_script_build-48d234ab88b13491 · Fastly, Inc. · 1 file · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (code-graph-dist) via crates.io · 4,962 files · went into an output ecosystem
Vulnerabilities4PackageFixSeverity
RUSTSEC-2026-0346rustls 0.23.40>=0.23.46high
RUSTSEC-2026-0348rustls 0.23.40>=0.23.46high
RUSTSEC-2026-0349rustls 0.23.40>=0.23.46high
GHSA-2mjx-qc3c-rqvcrustls 0.23.40>=0.23.45medium
Dependencies105Build behaviour
base640.22.1
bitflags2.13.0
block-buffer0.10.4
bumpalo3.20.3
cc1.2.63
cfg-if1.0.4
cpufeatures0.2.17
crc32fast1.5.0build script
crypto-common0.1.7
digest0.10.7
displaydoc0.2.6proc macro
equivalent1.0.2
filetime0.2.29
find-msvc-tools0.1.9
flate21.1.9
form_urlencoded1.2.2
generic-array0.14.7build script
getrandom0.2.17
hashbrown0.17.1
hex0.4.3
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
indexmap2.14.0
ld-linux-x86-64.so.2system library
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
litemap0.8.2
log0.4.32
memchr2.8.1
miniz_oxide0.8.9
once_cell1.21.4
percent-encoding2.3.2
potential_utf0.1.5
proc-macro21.0.106build script
quote1.0.45build script
ring0.17.14build scriptprebuilt objects
rustix1.1.4build script
rustls0.23.40build script
rustls-pki-types1.14.1
rustls-webpki0.103.13
sha20.10.9
shlex2.0.1
simd-adler320.3.9
smallvec1.15.2
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.117
synstructure0.13.2
tar0.4.46
thiserror2.0.18build script
thiserror-impl2.0.18proc macro
tinystr0.8.3
typenum1.20.1
unicode-ident1.0.24
untrusted0.9.0
ureq2.12.1
url2.5.8
utf8_iter1.0.4
webpki-roots0.26.11
webpki-roots1.0.7
writeable0.6.3
xattr1.6.1
yoke0.8.3
yoke-derive0.8.2proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.8.2
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
zip2.4.2build script
zopfli0.8.3
adler22.0.1
arbitrary1.4.2
crossbeam-utils0.8.21build script, not run
derive_arbitrary1.4.2proc macro
errno0.3.14
serde1.0.228build script, not run
serde_core1.0.228build script, not run
serde_derive1.0.228proc macro
version_check0.9.5
wasi0.11.1+wasi-snapshot-preview1
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
Versions52RiskVulnsPublished
1.6.44d ago
1.6.2not analyzed2026-07-10
1.6.1not analyzed2026-07-08
1.6.0not analyzed2026-07-07
1.5.0not analyzed2026-07-05
1.4.5not analyzed2026-07-01
1.4.4not analyzed2026-06-30
1.4.3not analyzed2026-06-27
1.4.2not analyzed2026-06-24
1.4.1not analyzed2026-06-22
1.4.0not analyzed2026-06-18
1.3.1not analyzed2026-06-15
1.3.0not analyzed2026-06-15
1.2.2not analyzed2026-06-14
1.2.1not analyzed2026-06-13
1.2.0not analyzed2026-06-11
1.1.13not analyzed2026-06-11
1.1.12not analyzed2026-06-11
1.1.11not analyzed2026-06-10
1.1.10not analyzed2026-06-10
1.1.9not analyzed2026-06-10
1.1.8not analyzed2026-06-09
1.1.7not analyzed2026-06-09
1.1.6not analyzed2026-06-09
1.1.5not analyzed2026-06-09
1.1.4not analyzed2026-06-09
1.1.3not analyzed2026-06-08
1.1.2not analyzed2026-06-08
1.1.1not analyzed2026-06-08
1.1.0not analyzed2026-06-07
1.0.27not analyzed2026-06-05
1.0.26not analyzed2026-06-04
1.0.25not analyzed2026-06-04
1.0.24not analyzed2026-06-04
1.0.23not analyzed2026-06-04
1.0.22not analyzed2026-06-02
1.0.21not analyzed2026-06-01
1.0.20not analyzed2026-05-31
1.0.19not analyzed2026-05-30
1.0.18not analyzed2026-05-30
1.0.17not analyzed2026-05-30
1.0.16not analyzed2026-05-30
1.0.15not analyzed2026-05-29
1.0.14not analyzed2026-05-29
1.0.13not analyzed2026-05-29
1.0.12not analyzed2026-05-27
1.0.11not analyzed2026-05-26
1.0.9not analyzed2026-05-25
1.0.8not analyzed2026-05-25
1.0.7not analyzed2026-05-25
1.0.6not analyzed2026-05-24
2.0.1highhigh

Raw data

capture
246 KB
records
34,361
bytes per record
7.1

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-16 · run 5295529e-3298-4f38-b14b-f1211e43d895

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2