{"name":"io.github.zhuzhen-team/feishu-user-plugin","slug":"zhuzhen-team-feishu-user-plugin","title":null,"description":"Feishu/Lark MCP server + CLI tool. 85 tools, 3 auth layers. Send as user via cookie+protobuf.","url":"https://mcp.market/server/zhuzhen-team-feishu-user-plugin","rating":null,"grade":"C","score":57,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":31,"stars":10,"forks":3,"downloads_week":132,"last_push_at":"2026-08-02T22:04:20.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/zhuzhen-team/feishu-user-plugin","website":null,"version":"1.4.1","remotes":[],"packages":[{"registryType":"npm","identifier":"feishu-user-plugin","version":"1.4.1","transport":{"type":"stdio"},"environmentVariables":[{"description":"Feishu web session cookie. Required for user-identity messaging tools (send_to_user, send_as_user, etc).","isSecret":true,"name":"LARK_COOKIE"},{"description":"Feishu Open Platform self-built app App ID (cli_xxxxxxxxxxxx). Required for Official API tools (docs, bitable, wiki, drive, calendar, tasks, OKR, group messaging).","name":"LARK_APP_ID"},{"description":"Feishu Open Platform self-built app App Secret. Used together with LARK_APP_ID.","isSecret":true,"name":"LARK_APP_SECRET"},{"description":"User OAuth UAT for P2P chat reading and as user-owner on resource creation. Obtained via 'npx feishu-user-plugin oauth'.","isSecret":true,"name":"LARK_USER_ACCESS_TOKEN"},{"description":"Refresh token for UAT auto-renewal.","isSecret":true,"name":"LARK_USER_REFRESH_TOKEN"}]}],"tools":[{"name":"add_reaction","description":"[Official API] Add an emoji reaction to a message.","write_action":false,"price_micros":0,"input_schema":null},{"name":"batch_send","description":"[User Identity / Official API] Send the same or different content to multiple targets in one call. Each target dispatches sequentially with a small delay (anti-rate-limit) and reports per-target success/error. Identity is the cookie user (user-identity sends) unless target.via=bot. Use for broadcast / fan-out scenarios.","write_action":true,"price_micros":0,"input_schema":null},{"name":"complete_task","description":"[Official API + UAT, v1.3.7] Mark a task complete (or uncomplete it). Convenience wrapper around update_task with completed_at.","write_action":false,"price_micros":0,"input_schema":null},{"name":"copy_wiki_node","description":"[Official API] Deep-copy a Wiki node into a different location (and optionally a different space). Underlying resource is duplicated.","write_action":false,"price_micros":0,"input_schema":null},{"name":"create_calendar_event","description":"[Official API + UAT, v1.3.7] Create a new calendar event. Requires `calendar:calendar.event:create` scope (re-run `npx feishu-user-plugin oauth` after enabling). The current identity (UAT-first) must have writer or owner permission on the calendar. Time fields: …","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_doc","description":"[Official API] Create a new Feishu document. Can place directly under a Wiki space by passing wiki_space_id (optionally wiki_parent_node_token for nested placement) — the plugin creates the doc in drive then attaches it as a Wiki node.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_folder","description":"[Official API] Create a new folder in Drive.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_group","description":"[Official API] Create a new group chat (as bot). Can add initial members.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_okr_progress_record","description":"[Official API + UAT, v1.3.7] Add a progress note to an OKR objective or key result. Feishu requires `source_title`, `source_url`, and a block-structured `content`; this tool exposes a simple `content_text` and auto-wraps it into the single-paragraph block format. Pass richer `content` directly if you need lists / mentions / docs links / images.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_p2p_chat","description":"[User Identity] Create or get a P2P (direct message) chat. Returns numeric chat_id.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_task","description":"[Official API + UAT, v1.3.7] Create a new task. summary is required; due / members / etc. are optional.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_wiki_node","description":"[Official API] Create a new Wiki node inside a space. obj_type picks the underlying resource (doc/sheet/bitable/mindnote/file/docx/slides). UAT-first so the resource is owned by the user.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_calendar_event","description":"[Official API + UAT, v1.3.7] Delete a calendar event. Requires `calendar:calendar.event:delete` scope.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_message","description":"[Official API] Recall/delete a message (bot can only delete its own messages).","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_okr_progress_record","description":"[Official API + UAT, v1.3.7] Delete an OKR progress record by its progress_id (from list_okr_progress_records).","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_reaction","description":"[Official API] Remove an emoji reaction from a message.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_task","description":"[Official API + UAT, v1.3.7] Permanently delete a task.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_wiki_node","description":"[Official API, v1.3.7] Delete a Wiki node. Calls `DELETE /open-apis/wiki/v2/spaces/{space_id}/nodes/{node_token}`. The Feishu SDK does not type this endpoint, so the call goes through raw REST (UAT-first; bot fallback uses `client.request`). **The underlying drive resource (docx / sheet / bitable / file) is NOT deleted** — Feishu treats wiki nodes as pointers. To delete the actual resource as well","write_action":true,"price_micros":0,"input_schema":null},{"name":"download_doc_image","description":"[User Identity / Official API] Download an image embedded in a docx document so the model can see it. Pass the `image_token` from `get_doc_blocks` (block.image.token), and optionally the doc/wiki/URL token to scope the lookup. UAT-first. **Size cap:** payloads > 2 MiB MUST pass `save_path`.","write_action":false,"price_micros":0,"input_schema":null},{"name":"download_message_resource","description":"[User Identity / Official API] Download an image or file attached to a message so the model can see / store it. v1.3.7 (C2.4) consolidates the v1.3.6 download_image (mode 1) + download_file. UAT-first, falls back to app. For images, the response includes an inline `image` content block so the model sees pixels. For files, the response includes the bytes as base64 (truncated for display) plus an op","write_action":false,"price_micros":0,"input_schema":null},{"name":"forward_message","description":"[Official API] Forward a message to another chat or user. `receive_id` may be a group chat_id (oc_xxx), an open_id (ou_xxx), a union_id, a user_id, or an email — set `receive_id_type` to match (default: chat_id).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_calendar_event","description":"[Official API + UAT] Get full details of a single calendar event (summary, description, start/end, attendees, location, attachments, meeting link).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_chat_info","description":"[Official API + User Identity fallback] Get chat details: name, description, member count, owner. Supports both oc_xxx and numeric chat_id.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_doc_blocks","description":"[Official API] Get structured block tree of a document. Returns block types, content, and hierarchy for precise document analysis. Follows pagination internally and returns ALL blocks by default — hasMore:false in the response guarantees the complete tree (pre-v1.3.17 silently capped at 500 blocks). For very large docs, pass max_blocks to bound one call (rounded up to 500/page granularity) and pag","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_freebusy","description":"[Official API + UAT, v1.3.7] Query freebusy windows for one or more users in a time range. Use to find a meeting slot. Requires `calendar:calendar:readonly` (already in default scope set).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_login_status","description":"Check cookie session validity and app credentials status. Also refreshes session.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_new_events","description":"[Plugin v1.3.9] Drain real-time events from the machine-level shared event log. v1.3.8 used per-process in-memory buffers (with duplicate-event problem); v1.3.9 uses ~/.feishu-user-plugin/events.jsonl with a single global cursor — every event delivered exactly once across all MCP processes on this machine. Default returns events from the current active profile only; pass profile=\"*\" to see all.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_okrs","description":"[Official API + UAT] Batch-fetch full OKR details (objectives, key results, progress, alignments) by OKR IDs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_task","description":"[Official API + UAT, v1.3.7] Get full details of a single task by GUID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_user_info","description":"[User Identity] Look up a user's display name by user ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_wiki_node","description":"[Official API] Resolve a Wiki node token to its underlying object (docx / bitable / sheet / mindnote / file). Returns obj_type + obj_token + space_id so you can read/write the real resource via the usual docx / bitable tools. Accepts bare wiki node token (wikcnXXX), an underlying obj_token (docxXXX / bascnXXX from search_wiki), or a full Feishu /wiki/ URL — the handler tries the wiki endpoint firs","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_calendar_events","description":"[Official API + UAT] List events in a calendar within an optional time range. Typical usage: first list_calendars to find calendar_id (primary calendar has type=\"primary\"), then list events in e.g. [now, now+7d] (Unix seconds).","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_calendars","description":"[Official API + UAT] List the current user's calendars (primary + shared + subscribed). Requires UAT — app identity only sees calendars it was explicitly invited to. Requires `calendar:calendar:readonly` scope on the OAuth.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_chats","description":"[Official API] List all chats the bot has joined. Returns chat_id, name, type.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_files","description":"[Official API] List files in a Drive folder. UAT-first with app fallback: with user identity (UAT), empty folder_token lists YOUR personal-space (\"我的空间\") root; via bot it can only see folders shared with the bot (personal-space folders return 403). Response carries viaUser so you know whose view you got. Use the returned file token with manage_drive_file to copy/move/delete.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_members","description":"[Official API] List all members in a group chat.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_okr_periods","description":"[Official API + UAT] List OKR periods (quarters / years) defined in the tenant. Use period_ids from this to filter list_user_okrs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_okr_progress_records","description":"[Official API + UAT, v1.3.7] List progress records for an OKR. Feishu has no native list endpoint — this tool calls get_okrs internally and walks the objective_list / kr_list to extract progress_record IDs (with their target_id and target_type). To read a record's full content, you currently need progressRecord.get (not yet wrapped).","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_profiles","description":"[Plugin] List all available identity profiles (each profile has its own LARK_COOKIE / APP_ID / APP_SECRET / UAT). v1.3.9 SSOT: profiles live in ~/.feishu-user-plugin/credentials.json::profiles. Legacy fallback: LARK_PROFILES_JSON env var. Marks the currently active profile.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_tasks","description":"[Official API + UAT, v1.3.7] List the current user's tasks. Filter by completion or type.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_user_chats","description":"[User UAT] List group chats the user is in. Note: only returns groups, not P2P. For P2P chats, use search_contacts → create_p2p_chat → read_p2p_messages. Requires OAuth setup.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_user_okrs","description":"[Official API + UAT] List a user's OKRs. Requires the user's open_id (get yours via get_login_status or search_contacts). Filter by period_ids to narrow to a specific quarter.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_wiki_nodes","description":"[Official API] List nodes in a Wiki space (50 per page). When hasMore is true, pass the returned pageToken back as page_token to fetch the next page. A page may be EMPTY while hasMore is still true (Feishu permission-filters per page) — do not stop at an empty page; keep paging until hasMore is false.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_wiki_spaces","description":"[Official API] List all accessible Wiki spaces. Follows pagination internally and returns ALL spaces (pre-v1.3.17 silently capped at 50). If the upstream cursor stalls, the response carries truncated:true + cursorUnavailable:true instead of hasMore:true because there is no safe resume cursor.","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_bitable_app","description":"[Official API] Manage a Bitable app. action=create (new app, optional wiki_space_id to attach), copy (duplicate an existing app), get_meta (read app metadata).","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_bitable_field","description":"[Official API] Manage fields (columns) inside a Bitable table. action=list, create, update (Feishu requires `type` even when only renaming), delete.","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_bitable_record","description":"[Official API] Manage records (rows) inside a Bitable table. action=search, get, create, update, delete. create/update/delete accept arrays — single record or up to 500.","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_bitable_table","description":"[Official API] Manage a table inside a Bitable app. action=list, create (with optional initial fields), update (rename), delete.","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_bitable_view","description":"[Official API] Manage views inside a Bitable table. action=list, create, delete. (Feishu open API does not expose view update — recreate with a new name to change.)","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_doc_block","description":"[Official API] Manage content blocks in a document. Single tool replaces v1.3.6 create_doc_block / update_doc_block / delete_doc_blocks. action=create — six modes (pass exactly ONE): (A) Generic — pass `children` array (e.g. [{block_type:2, text:{...}}]). (B) Image from local file — pass `image_path`; plugin uploads and patches. (C) Image from token — pass `image_token` (already uploaded). (D) Fil","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_drive_file","description":"[Official API] Manage a Drive file/doc/folder. action=copy (duplicate to a new name + folder), move (relocate, returns task_id), delete (remove, returns task_id). `type` is always required (Feishu rejects with 1061002 / 1062501 otherwise).","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_members","description":"[Official API] Add or remove members from a group chat. The Feishu API rejects with code 9499 when the IDs in `member_ids` do not match `member_id_type` — pass `member_id_type` explicitly when using union_id or user_id (default: open_id).","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_profile_hints","description":"[Plugin v1.3.8] Inspect / set / clear profileHints — the resourceKey → profileName cache the auto-switch middleware uses to remember which profile owns each Feishu resource. Useful when a hint goes stale (e.g., a profile lost access to a doc).","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_task_members","description":"[Official API + UAT, v1.3.7] Add or remove members on a task. Members are objects {id:\"<open_id>\", role:\"assignee\"|\"follower\", type?:\"user\", name?:\"\"}.","write_action":false,"price_micros":0,"input_schema":null},{"name":"manage_ws_status","description":"[Plugin v1.3.9] Inspect or control the machine-level WS owner. Actions: info (status dump), reconnect (owner-only; restart WS), claim (try become owner; force=true to steal active lock), rotate (owner-only; force events.jsonl rotation), reconfig (owner-only; re-read credentials.json + apply event subscriptions).","write_action":false,"price_micros":0,"input_schema":null},{"name":"move_wiki_node","description":"[Official API] Move a Wiki node to a different parent (within the same space) or to a different space. Pass at least one of target_parent_token / target_space_id.","write_action":false,"price_micros":0,"input_schema":null},{"name":"pin_message","description":"[Official API] Pin or unpin a message in a chat.","write_action":false,"price_micros":0,"input_schema":null},{"name":"read_doc","description":"[Official API] Read the raw text content of a Feishu document.","write_action":false,"price_micros":0,"input_schema":null},{"name":"read_doc_markdown","description":"[Plugin v1.3.9] Read a Feishu doc as Markdown (vs get_doc_blocks JSON). Saves ~60% tokens for RAG / digest / summarisation use cases. Accepts native docx token, wiki node token, or full Feishu URL. Embedded images / files appear as feishu://image_token/<TOKEN> placeholders — call download_doc_image for the binary if needed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"read_messages","description":"[Official API + UAT fallback] Read message history from any group. Accepts oc_xxx ID, numeric ID, or chat name (auto-searched). Auto-falls back to UAT for external groups the bot cannot access. Returns newest messages first by default, with sender names resolved. Auto-expands merge_forward messages into their child messages (with original sender / time / content preserved) by default — disable wit","write_action":false,"price_micros":0,"input_schema":null},{"name":"read_p2p_messages","description":"[User UAT] Read P2P (direct message) chat history using user_access_token. Works for chats the bot cannot access. Returns newest messages first by default. Auto-expands merge_forward messages into their child messages by default — disable with expand_merge_forward=false. Requires OAuth setup. **Sender semantics (v1.3.12)**: each message has a `displayLabel` (e.g. `周宇`, `[Bot] Claude聊天助手`, `[匿名]`, ","write_action":false,"price_micros":0,"input_schema":null},{"name":"reply_message","description":"[Official API] Reply to a specific message by message_id (as bot). Only works for text messages; other types return error 230054.","write_action":false,"price_micros":0,"input_schema":null},{"name":"respond_calendar_event","description":"[Official API + UAT, v1.3.7] Respond to an event invitation. The current identity must be in the event's attendee list. Requires `calendar:calendar.event:reply` scope.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_contacts","description":"[User Identity] Search Feishu users, bots, or group chats by name. Returns IDs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_docs","description":"[Official API] Search Feishu documents by keyword. UAT-first with app fallback: with user identity (UAT) the search covers docs visible to YOU, including your personal space; via bot it only covers docs shared with the bot. Response carries viaUser; when hasMore is true, pass the returned nextOffset back as offset to page forward.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_messages","description":"[User UAT, v1.3.12] Search the user's IM history by keyword. Wraps Feishu `POST /open-apis/search/v2/message`. Requires UAT with the `search:message` scope (re-run `npx feishu-user-plugin oauth` after v1.3.12 SCOPES update). Feishu does NOT expose a bot-path search; if you only have app credentials this tool will error. Returns `{items, pageToken, hasMore}` where each item is a `{message_id, chat_","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_wiki","description":"[Official API] Search Wiki nodes by keyword. UAT-first with app fallback: with user identity (UAT) the search covers wiki spaces visible to YOU; via bot it only covers spaces the bot was invited to. Response carries viaUser; when hasMore is true, pass the returned nextOffset back as offset to page forward.","write_action":false,"price_micros":0,"input_schema":null},{"name":"send_as_user","description":"[User Identity] Send a text message as the logged-in Feishu user. Supports reply threading and real @-mentions (triggers push notifications).","write_action":true,"price_micros":0,"input_schema":null},{"name":"send_card_as_user","description":"[v1.3.9+: bot-only] Send an interactive Feishu card to a chat via bot identity (Official API). User-identity cookie protobuf path is server-side disabled at the auth tier — confirmed by exhaustive brute-force in v1.3.9, see scripts/explore-card-protobuf.js. The \"as_user\" suffix is historical naming kept for backward compat; the tool always routes through bot. Pass `card` as a JSON object (Feishu c","write_action":true,"price_micros":0,"input_schema":null},{"name":"send_file_as_user","description":"[User Identity] Send a file as the logged-in user. Requires file_key (upload via Official API first).","write_action":true,"price_micros":0,"input_schema":null},{"name":"send_image_as_user","description":"[User Identity, v1.3.9] Send an image as the logged-in user (NOT bot). Requires image_key from a prior upload_image call. Cookie-protobuf wire format requires both imageKey + thumbnailKey — when no separate thumbnail is provided, plugin defaults thumbnailKey to imageKey (Feishu accepts this for messenger-uploaded images). Width/height/mime/size are optional metadata; Feishu auto-derives display si","write_action":true,"price_micros":0,"input_schema":null},{"name":"send_message_as_bot","description":"[Official API] Send a message as the bot to any chat. Supports text, post, interactive, etc. This is the reliable path for @-mentions: include `<at user_id=\"ou_xxx\">Name</at>` inline in text content and Feishu resolves it to a real @-notification.","write_action":true,"price_micros":0,"input_schema":null},{"name":"send_post_as_user","description":"[User Identity] Send a rich text (POST) message with title and formatted paragraphs. Supports real @-mentions that trigger notifications.","write_action":true,"price_micros":0,"input_schema":null},{"name":"send_to_group","description":"[User Identity] Search group by name → send text message. All in one step.","write_action":true,"price_micros":0,"input_schema":null},{"name":"send_to_user","description":"[User Identity] Search user by name → create P2P chat → send text message. All in one step.","write_action":true,"price_micros":0,"input_schema":null},{"name":"switch_profile","description":"[Plugin v1.3.9] Switch the active identity profile. Atomically writes credentials.json::active; cached clients in this process are invalidated; cross-process MCPs (Codex / another Claude Code) auto-sync via dispatcher mtime check on next tool call (~10μs). To add a new profile, run `npx feishu-user-plugin setup --profile <name> --app-id ... --app-secret ... --cookie ...` then `npx feishu-user-plug","write_action":false,"price_micros":0,"input_schema":null},{"name":"update_calendar_event","description":"[Official API + UAT, v1.3.7] Patch fields on an existing calendar event. Pass only the fields you want to change. Requires `calendar:calendar.event:update` scope.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_group","description":"[Official API] Update group chat name or description.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_message","description":"[Official API] Edit a sent message (bot can only edit its own messages). Feishu supports edit only for `text` and `interactive` (card) messages — other types (post, image, file, etc.) are rejected by the API.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_task","description":"[Official API + UAT, v1.3.7] Patch a task. **update_fields** is required by Feishu — list which fields to update (e.g. [\"summary\",\"due\",\"completed_at\"]).","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_wiki_node","description":"[Official API] Rename a Wiki node (only `title` is updatable via the wiki API; the underlying resource content is edited via docx/bitable/sheet tools).","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_bitable_attachment","description":"[Official API] Upload a file as a Bitable attachment (drive/v1/medias/upload_all with parent_type=bitable_image or bitable_file). Returns file_token suitable for writing into a Bitable Attachment-type field via batch_create/update_bitable_records (the field value should be [{file_token}]).","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_drive_file","description":"[Official API] Upload a file from disk to a Feishu Drive folder (drive/v1/files/upload_all, parent_type=explorer). Returns file_token + url. If wiki_space_id is provided, the uploaded file is then attached to that Wiki space via move_docs_to_wiki (obj_type=file). UAT-first with app fallback.","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_file","description":"[Official API] Upload a file to Feishu. Returns file_key for use with send_file_as_user.","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_image","description":"[Official API] Upload an image file to Feishu. Returns image_key for use with send_image_as_user.","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":57,"grade":"C","scanned_at":"2026-09-26T11:38:26.547Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-26T11:38:26.628Z","components":{"code":{"score":13,"max":25,"notes":["109 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":12,"max":15,"notes":["last push 55 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.shell-concat","severity":"high","component":"code","title":"Shell command built from a string (injection risk)","evidence":"src/test-all.js: … locked write contract ]) { try { execSync(`node ${_p.join(__dirname, t + '.js')}`, { stdio…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"feishu-user-plugin","version":"1.4.1","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":5,"publishedAt":"2026-07-02T10:08:13.007Z","repositoryUrl":"git+https://github.com/EthanQC/feishu-user-plugin.git","weeklyDownloads":132}],"repo":{"found":true,"owner":"zhuzhen-team","repo":"feishu-user-plugin","archived":false,"pushedAt":"2026-08-02T22:04:20Z","stars":10,"forks":3,"openIssues":3,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/164586007?v=4","ownerCreatedAt":"2026-02-27T16:55:25Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/164586007?v=4&s=128","source":"github"},"presence":{"stars":10,"forks":3,"downloadsWeek":132,"license":"MIT","lastPushAt":"2026-08-02T22:04:20.000Z","score":31}}}},"grade_history":[],"reviews":[]}