github JavaScript analyzed 20fac1c unconfirmed MCP

63Klabs/atlantis-mcp

Atlantis MCP Server to assist in AI development of applications using the Atlantis Templates and Scripts Platform

Drift inferred · capture-to-capture

HIGH 2026-08-01 code analysis flagged dynamic code execution ×7 in 63Klabs/atlantis-mcp

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 20fac1c · analyzer v28 · 1d ago

code evidence vv0.0.4 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 283

fs 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/postdeploy-scripts/apply-settings.js :23 const fs = require('fs');
fs 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/postdeploy-scripts/resolve-and-render-spec.js :14 const fs = require('fs');

shell 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/src/lambda/indexer/lib/file-filter.js :56 return new RegExp(`^${escaped}$`);

net 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/src/lambda/auth/utils/jwt-validator.js :21 const https = require('https');
net 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/src/lambda/indexer/lib/github-client.js :3 const https = require('https');
net 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/src/lambda/indexer/lib/index-builder.js :3 const http = require('http');
net 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/src/lambda/read/config/settings.js :415 * const response = await fetch('https://api.github.com/user/repos', {
net 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/src/lambda/read/models/github-api.js :173 const response = await fetch(url, {

secrets 63Klabs-atlantis-mcp-20fac1c/application-infrastructure/src/lambda/indexer/lib/index-builder.js :86 const sessionToken = process.env.AWS_SESSION_TOKEN;