inspo-mcp 0.1.16 — Security Check

version 0.1.16 · checked 9/16/2026, 4:52:42 AM · idc-0.3.0

Nothing alarming turned up in inspo-mcp@0.1.16. 4 medium findings, including unusually dense code lines. It was published 34 hours ago without provenance. Read the findings before you install it.

Risk score 36/100 · Automated risk assessment. Not a guarantee of safety.

Findings

medium

Unusually dense code lines

dense-lines

A source file has extremely long, high-entropy lines. That is normal for minified bundles but unusual for readable source — worth a glance at the file listed below.

inspo-mcp.mjs
var reference_components_default = [{ id: "banded", type: "cta", label: "Banded", macro: "Accent Band", note: "Full-bleed accent ribbon with one action. Earns its loudness by being the only one on the

medium

Runs other programs

child-process

The package starts processes on your machine. Common for CLI tools, worth knowing about.

inspo-mcp.mjs · line 45613
  return spawnSync(probe, [bin], { stdio: "ignore" }).status === 0;
}
function run(bin, args) {

medium

Writes files in your home folder

fs-write-home

The package writes into your home directory — often client config files. Check what it changes before installing.

inspo-mcp.mjs · line 45606
var HOME = homedir();
var IS_WIN = platform() === "win32";
function tilde(path2) {

medium

Published in the last 72 hours

fresh-release

Brand-new versions have had no time to be reviewed. Waiting a few days is cheap insurance.

2026-09-14T19:18:16.209Z

Supply chain

Released: 9/14/2026, 7:18:16 PM
Provenance: none
Maintainers: hassanelmghari, luffixos
Releases: 16 published · latest 0.1.16
Repository: https://github.com/Nutlope/inspo

Outbound domains

github.com · knowninspomcp.dev · unknownraw.githubusercontent.com · knownjson-schema.org · knowntools.ietf.org · unknowngist.github.com · knownmathiasbynens.be · unknownwww.safaribooksonline.com · unknownspec.openapis.org · unknownstackoverflow.com · unknownwww.w3.org · knownexample.com · knownwww.postgresql.org · unknownorm.drizzle.team · unknowndocs.expo.dev · unknownapi.together.ai · unknowndocs.together.ai · unknownapi.together.xyz · unknownlinear.app · unknownvercel.com · unknownare.na · unknownwww.together.ai · unknownlocalhost · known0nme3pk5am3urwa9.public.blob.vercel-storage.com · unknownfeross.org · unknown

Safe config

# Approved by Bouncer Security Check, scan e570d6a6-cb2b-4c45-8b12-515cd673c131
claude mcp add inspo-mcp -- npx -y inspo-mcp@0.1.16