TL, DR
@szc-ft/mcp-szcd-client wani abokin ciniki ne na Model Context Protocol (MCP) wanda aka buga zuwa npm wanda ke saita mataimakan lambar AI ta atomatik - nau'in fakitin manne da mai haɓakawa ya girka don wakilin IDE ya iya magana da sabis na ɗakin karatu. Yana da dogon tarihin fitarwa mai kama da na yau da kullun (71 versions) kuma matakin shigarwa mai sauƙi. Babu wani abu a cikin shigarwar bayan shigarwa da ya taɓa takardun shaidarka.
Halayyar karanta takardun shaida tana rayuwa a cikin wani tsari mai zurfi, a cikin ƙwarewar MCP mai haɗawa da ake kira local-browser-testLokacin da wannan ƙwarewar ta kasance connect() gudanar da ayyukan yau da kullun, yana ƙarfafa _decryptCredentials() - wanda ke decrypts kowace kalmar sirri da aka adana a cikin bayanin martaba na Chrome/Edge na gida (duk shafuka, ba aikace-aikacen guda ɗaya da gwajin burauza zai yi niyya ba) ta amfani da Windows Data Protection API (DPAPI) da AES-256-GCM. An rubuta saitin da aka warware a cikin rubutu mai sauƙi zuwa ~/.szcd-mcp/deps/decrypted-creds.json kuma an mayar da shi cikin sakamakon kayan aikin MCP na ƙwarewar, wanda ke gudana zuwa sabar MCP mai nisa ta fakitin, mcp.szcd-mcp.top.
Wannan tsari ne na sarkar samar da kayayyaki wanda ya cancanci a sanya masa suna: Ƙarfin da ba shi da ƙarfi ba ya cikin ƙugiya mai shigarwa (inda yawancin na'urorin daukar hoto da masu bita ke kallo) amma a cikin ƙwarewar MCP wanda ke aiki ne kawai lokacin da mai aiki ya nuna kayan aikin zuwa burauzar da yake gudana. Muna kiransa da shi. SkillLeakMEW yana rarrabawa @szc-ft/mcp-szcd-client (versions 0.38.0 da kuma 0.39.0) kamar mugunta.
Bayanin lokaci - Kwarewar MCP: tarin umarni da rubutun taimako da uwar garken MCP ke nunawa ga wakilin AI a matsayin ikon da za a iya kira. Wakilin yana kiransa kamar kayan aiki; rubutun yana gudana akan injin mai haɓakawa.
Hari da Jiki
Kunshin yana nuna fuskoki biyu daban-daban.
Fuskar da mai bita ya fara gani shine hanyar shigarwa. Manunin ya bayyana bayan shigarwa: rubutun node/postinstall.js, kuma wannan rubutun yana yin daidai abin da README ya ce: yana da waya MCP haɗakarwa cikin IDEs kuma shigar da fakitin 'yan'uwa, @szc-ft/sketch-mcp-serverBa ya taɓa isa ga lambar shaidar. Na'urar daukar hoto da ke tsayawa a lokacin shigarwa hooks — wurin da ya fi kowanne wuri a tarihi a sigina — yana ganin kayan aikin haɓaka mai tsabta, wanda ba shi da ban mamaki. A gaskiya ma an tantance wannan fakitin a matsayin amintacce a cikin takardar bita ta baya.
Fuskar da ke da mahimmanci Ana isa ne kawai ta hanyar ƙwarewar da aka haɗa. Sarkar:
- Mai haɓakawa yana gudanar da shi gwajin-bincike na gida sun fara da tashar cire kurakurai ta nesa. Wannan ita ce hanyar da aka rubuta don amfani da ƙwarewar.
- Kwarewa haɗa () (lib/browser-engine.js) kira _decryptCredentials() a layi na 246.
- _decryptCredentials() da kira decryptAllPasswords({ tacewa: '%'}). The '%' tacewa shine cikakken bayani da ke mayar da sauƙin gwaji zuwa girbi: yana dacewa da kowane asali da aka adana maimakon wurin da aka gwada.
- lib/decrypt-passwords.js yana karanta browser ɗin os_crypt maɓalli mai ɓoyewa, yana gudana powershell … KariyaData::Unprotect (DPAPI) don dawo da maɓallin AES, sannan AES-256-GCM-yana cire duk bayanan da aka adana.
- An rubuta cikakken saitin da aka ɓoye zuwa ga ~/.szcd-mcp/deps/decrypted-creds.json a cikin rubutu mai haske kuma an dawo da shi azaman ƙwarewar Kayan aikin MCP sakamakon.
- Wannan sakamakon yana komawa ta hanyar tashar MCP zuwa sabar da aka saba da ita a cikin fakitin, mcp.szcd-mcp.top - wannan mai masaukin baki da aka rubuta a cikin README da kuma a ciki rubutun/lib/common.js.
Takaitaccen bayani kan dalilin da yasa mataki na 4 ke aiki kwata-kwata. A kan Windows, Chrome da Edge ba sa adana kalmomin shiga da aka adana a cikin rubutu mai sauƙi: kowane takardar shaidar an ɓoye shi da maɓallin AES-256-GCM, kuma wannan maɓallin da kansa an rufe shi da DPAPI, wanda ke haɗa shi da asusun mai amfani na yanzu. Don haka dawo da kalmar sirri yana ɗaukar matakai biyu - da farko Bayanan Kariya::Ba a Kare su ba don dawo da maɓallin AES (wanda ke nasara saboda lambar tana gudana azaman mai amfani da aka shiga, daidai yanayin da tashar mai haɓakawa ke bayarwa), sannan a karanta fassarar GCM na kowane toshe da aka adana daga mai binciken os_crypt-shagon kariya. Wannan an fahimta sosai, ba a haɗa shi da intanet ba, kuma shiru ne: babu buƙatar kalmar sirri ta master-password, babu hulɗar mai bincike, babu hanyar sadarwa ta dawowa har sai an tura sakamakon. Wannan shine ainihin abin da masu satar bayanai na kayayyaki ke amfani da shi - sabon abu a nan shine kawai abin rufewa da ke ɗauke da shi.
Mai cire bayanai ba ya faruwa a lokaci gudaAn haɗa shi sau uku - a ƙasa standard-ƙwarewa/, tsawaita lambar buɗewa/, Da kuma tsawo na qwen/ - kwafi ɗaya ga kowane saman mai taimakawa AI, don haka ikon yana tafiya tare da duk wanda mai haɓaka ya haɗa.
Bambancin da ingantaccen gwajin-bincike na atomatiklogin shine cikakken labarin. Mai taimakawa gwaji na gaske yana warware bayanan shaidar don daya aikace-aikacen shi ne exercisecising, yana amfani da shi a cikin tsari, kuma baya taɓa ci gaba ko tura shi. A nan tsarin yana warware komai, yana rubuta shi zuwa faifai a sarari, kuma yana mayar da shi ta kan iyakar hanyar sadarwa zuwa uwar garken nesa.
Jadawalin lokaci & Abin da ke Faruwa
Halaye biyu suna da mahimmanci don fahimtar bayyanar cututtuka.
Abin da ke jawowa shine zaɓi, ba atomatik ba. Shigar da fakitin ba ya karanta duk wani shaidar da aka bayar. Fahimtar bayanai tana aiki ne kawai lokacin da mai haɓakawa ya fara amfani da shi. gwajin-bincike na gida Kwarewa a kan burauzar da suka ƙaddamar a yanayin cire kurakurai daga nesa. Wannan yana rage girman wanda abin ya shafa idan aka kwatanta da postinstall kayan aiki wanda ke haskaka kowane npm shigarwa.
Marufin ya tsufa, ba abin wasa ba ne. Mai wallafawa ya aika da nau'ikan 71 kuma yana kula da faffadan @szc-ft Tsarin MCP na ɗakunan karatu na component-laburare. Mai warware bayanai yana nan a cikin nau'ikan da aka yiwa alama (0.38.0 da 0.39.0) tare da yatsa iri ɗaya, wanda aka kira daga ɗaya burauzar-engine.js:246 Wurin shiga. Kunshin zai ci gaba da aiki a npm a lokacin rubuta wannan.
Wannan haɗin - mai buga takardu da aka kafa, matakin shigarwa mai sauƙi, da kuma ikon da ke aiki ne kawai a ƙarƙashin takamaiman tsarin aiki na zaɓi - shine ainihin dalilin da ya sa mai rarraba bayanai ta atomatik ya annabta "lafiya" kuma wani bita na baya ya amince. Halin yana warwarewa ne kawai ta hanyar karanta rubutun taimakon fasaha da hannu.
Alamomin Yarjejeniya
Masu kare suna duba Kayan aikin MCP ya kamata a yi maganinsa fasaha kundin adireshi a matsayin in-scope, ba kawai manifest da install scripts ba.
Ba da izini & ɗabi'ar da aka lura
Mukan bayyana hali, ba dalili ba.
An buga fakitin a ƙarƙashin asusun npm da aka kafa tare da fakiti mai jituwa da yawa @szc-ft Tsarin MCP da kuma dogon tarihin sigar. Babu wani tsari na musamman na umarni da sarrafawa: ana dawo da bayanan da aka cire ta hanyar sabar MCP da aka rubuta a cikin fakitin, mcp.szcd-mcp.top, maimakon zuwa wurin da ba a san ko wanene ba. Matakin shigarwa ba shi da matsala.
Abin da ya motsa wannan daga "fasalin sauƙin kai hari" zuwa rarrabuwar mugunta shine haɗin da ake iya gani ta hanyar amfani da maƙasudi da kuma inda za a nufa: tsarin warware bayanai na yau da kullun dukan adana bayanan burauzar maimakon aikace-aikacen guda ɗaya da gwajin zai yicise, yana ci gaba da sanya su a cikin faifai a cikin rubutu mai sauƙi, kuma yana watsa su daga mai masaukin baki a cikin tashar MCP. Gwajin burauza ta atomatik-login Siffar da ta yi irin wannan aiki ba za a iya bambanta ta ba, a zahiri, da tattara takardun shaida - kuma tasirin shine abin da mai kare dole ne ya yi tunani a kai.
Gaskiya mun lura cewa abin da ke haifar da wannan matsala shine zaɓi kuma an tabbatar da mai wallafa; dukkan waɗannan bayanai suna cikin bayanan da ke sama. Babu ɗayansu da ke canza sakamakon da za a iya gani ga mai haɓaka wanda ke gudanar da ƙwarewar: kalmomin shiga da aka adana don kowane rukunin yanar gizo a cikin bayanin martabar burauzar su suna barin na'urar.
Tasiri, yanayi & jagorar mai kare
SkillLeak lamari ne na fakiti ɗaya, amma wurin isar da sako da yake amfani da shi shine ma'anar.
An daidaita hanyoyin samar da kayayyaki na masana'antar zuwa ga aiwatar da lokacin shigarwa: shigarwa kafin lokaci/postinstall hooks, alamun rikice-rikice na dogaro, alamun rubutu tare da ƙarin nauyi a ciki index.js. MCP yana canza yanayinKunshin MCP zai iya aika da takardar shaidar aiki da kuma matakin shigarwa wanda yake da tsabta gaba ɗaya yayin da yake ɗauke da sakamakonsa a cikin fasaha — wani fakitin da wakilin AI zai kira daga baya, bisa umarnin mai haɓakawa, akan albarkatun mai haɓakawa. Ƙarfin yana tafiya tare da haɗin mataimaki kuma yana kwance har sai wani aiki mai kama da na al'ada ("gudanar da gwajin mai bincike") ya kunna shi.
Ga ƙungiyoyin da ke amfani da kayan aikin MCP:
- Kwarewar duba kuɗi, ba wai kawai tana bayyana ba. Faɗaɗa bitar fakitin zuwa ƙwarewa/, *-tsawo/, da kuma kundin adireshi masu kama da juna. Lambar da ta fi saurin fahimta ba za ta taɓa bayyana a cikin ƙugiyar shigarwa ba.
- Kula da kumbura a sararin samaniya. Ƙarfin da ke da'awar kunkuntar manufa (gwada manhaja ɗaya) amma yana aiki sosai (matattara: '%' a kan duk asalin da aka adana) alama ce ta ja ba tare da la'akari da niyya ba.
- Yi amfani da sakamakon kayan aikin MCP a matsayin hanyar fita. Bayanan da aka dawo daga wata fasaha suna barin mai masaukin baki zuwa duk wani sabar MCP da aka tsara wa abokin ciniki. Kiyaye waɗannan wurare kamar yadda za ku yi da kowace hanyar sadarwa ta waje.
- Sake duba sigar da ta ƙunshi fakitin MCP masu "amintattu". Mai wallafa da aka kafa da kuma tarihin fitowar da ya daɗe ba su dace da karanta lambar da ke cikin kowace sigar ba - kamar yadda wannan yanayin, wanda ke juya kimantawa mai aminci a baya, ya nuna.
A zahiri, bincike uku masu rahusa za su bayyana wannan fakitin kafin wani mai haɓaka ya gudanar da ƙwarewar. Da farko, duba abubuwan da ke cikin kundin adireshi na ƙwarewa don samun damar shiga shagon takaddun shaida na gida - nassoshi zuwa os_crypt, Bayanan da aka Kare/DPAPI, ko kuma browser Login data fayil — yana nuna ikon ko da wane ƙugiya na shigarwa yake. Na biyu, duba sikelin akan duk wani tsari na decrypt/reading wanda ke karɓar zaɓin wildcard (matattara: '%' da kuma daidai) maimakon mai ganowa mai ɗaure yana kama hauhawar farashin gwaji-zuwa-girbi. Na uku, bambanta saitin masu masaukin baki da fakitin zai iya kaiwa (a nan, mcp.szcd-mcp.top) a kan wuraren da takardun da ake buƙata ke buƙatarsu, yana mai da hanyar sakamakon MCP zuwa wurin fitarwa mai iya dubawa. Babu ɗayan waɗannan da ke buƙatar gudanar da lambar.
Fahimtar Bayanan Takardu ta hanyar DPAPI da os_crypt tsohuwar dabara ce; isar da ita ta hanyar ƙwarewar AI-wakili wanda ke aiki ne kawai a ƙarƙashin tsarin aiki na zaɓi shine sabon faifan. Yi tsammanin ƙarin tsarin iyawa-a-gwani yayin da kayan aikin MCP ke yaduwa, kuma daidaita iyakokin bita daidai gwargwado.
