mcp-servers-for-revit-integration

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The package intentionally exposes high-risk capabilities — notably an arbitrary C# execution endpoint ("send_code_to_revit"), a WebSocket bridge between Revit and an external MCP server, and data-extraction + arbitrary-SQL tools — which together enable remote code execution and easy data exfiltration and also rely on automatic npm installs (npx -y) that present supply-chain risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Claude Desktop configuration and troubleshooting steps instruct running "npx -y mcp-server-for-revit", which at runtime fetches and executes the mcp-server-for-revit package from the npm registry (e.g. https://registry.npmjs.org/mcp-server-for-revit), so remote code is retrieved and executed to control the agent integration.