Server-agnostic MCP testing framework and full-stack MCP App framework for ChatGPT Apps, Claude Connectors, and more.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit afba9b7 · analyzer v33 · 2d ago
skills & prompt files 3
danger signals8
- dynamic code execution new Function() Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/extract-resource.mjs :52
new Function('module', 'exports', 'require', code)(mod, mod.exports, () => ({})); - dynamic code execution new Function() Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/extract-tool.mjs :59
const fn = new Function(code + '\nreturn tool;'); - dynamic code execution new Function() Alignbase-sunpeak-afba9b7/packages/sunpeak/src/inspector/inline-helper-runtime.test.ts :41
const fn = new Function('window', 'document', SUNPEAK_INLINE_HELPER_SCRIPT); - dynamic code execution new Function() Alignbase-sunpeak-afba9b7/packages/sunpeak/src/lib/extract-resource.ts :54
new Function('module', 'exports', 'require', code)(mod, mod.exports, () => ({})); - dynamic code execution new Function() Alignbase-sunpeak-afba9b7/packages/sunpeak/src/lib/extract-tool.ts :64
const fn = new Function(code + '\nreturn tool;'); - suspicious endpoint 169.254.169.254 (cloud metadata) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/cli/inspect.test.ts :452
_securityTestExports.assertHttpServerUrlAllowed('http://169.254.169.254/latest') - suspicious endpoint 93.184.216.35 Alignbase-sunpeak-afba9b7/packages/sunpeak/src/cli/inspect.test.ts :620
headers: { Location: 'https://93.184.216.35/oauth/metadata' }, - suspicious endpoint 93.184.216.34 Alignbase-sunpeak-afba9b7/packages/sunpeak/src/cli/inspect.test.ts :627
guardedFetch('https://93.184.216.34/.well-known/oauth-authorization-server', {
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 374
filesystem 25
- fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/build.mjs :2
import { existsSync, rmSync, readdirSync, readFileSync, writeFileSync, mkdirSync, copyFileSync, unlinkSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/dev.mjs :2
import * as fs from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/inspect.mjs :16
import * as fs from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/new.mjs :2
import { existsSync, mkdirSync, cpSync, readFileSync, writeFileSync, renameSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/start.mjs :2
import { existsSync, readFileSync, readdirSync } from 'fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/test-init.mjs :1
import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/test.mjs :2
import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/upgrade.mjs :3
import { readFileSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/eval/eval-vitest-plugin.mjs :15
import { readFileSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/live/browser-auth.mjs :1
import { mkdtempSync, mkdirSync, cpSync, existsSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/live/global-setup.mjs :21
import { existsSync, mkdirSync, statSync, unlinkSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/live/utils.mjs :1
import { readFileSync, rmSync } from 'fs';
show 13 more
- fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/patterns.mjs :6
import { existsSync, readdirSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/resolve-bin.mjs :9
import { existsSync } from 'fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/test/test-config.mjs :18
import { existsSync, readFileSync } from 'fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/sunpeak.js :3
import { existsSync, readFileSync } from 'fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/generate-examples.mjs :12
import { existsSync, rmSync, mkdirSync } from 'fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/generate-sandbox-html.mjs :15
import { mkdir, writeFile } from 'node:fs/promises'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/scope-embed-theme.mjs :26
import { readFileSync, writeFileSync, existsSync } from 'node:fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/validate.mjs :16
import { existsSync, readFileSync, readdirSync, writeFileSync, rmSync, mkdirSync, cpSync } from 'fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/cli/inspect.test.ts :4
import * as fs from 'fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/inspector/embed-css-output.test.ts :20
import { readFileSync, existsSync } from 'node:fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/inspector/sandbox-static.test.ts :20
import { readFileSync, existsSync } from 'node:fs'; - fs (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/mcp/server.test.ts :3
import fs from 'node:fs'; - fs Alignbase-sunpeak-afba9b7/packages/sunpeak/src/mcp/server.ts :4
import fs from 'node:fs';
shell / exec 12
- shell Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/dev.mjs :8
import { spawn } from 'child_process'; - shell Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/inspect.mjs :21
import { execFile, spawn } from 'node:child_process'; - shell Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/new.mjs :5
import { execSync, exec } from 'child_process'; - shell (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/test-init.mjs :2
import { execSync } from 'child_process'; - shell (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/test.mjs :1
import { spawn } from 'child_process'; - shell Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/upgrade.mjs :2
import { spawn } from 'child_process'; - shell Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/get-port.mjs :2
import { execFileSync } from 'child_process'; - shell Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/utils.mjs :1
import { execSync } from 'child_process'; - shell (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/generate-examples.mjs :11
import { execSync } from 'child_process'; - shell (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/run-oauth-conformance.mjs :3
import { spawnSync } from 'node:child_process'; - shell (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/validate.mjs :13
import { execSync, spawn } from 'child_process'; - shell (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/cli/commands.test.ts :1094
const { execSync } = await import('child_process');
network 18
- net (weak) Alignbase-sunpeak-afba9b7/examples/albums-example/src/server.ts :1
import type { IncomingMessage } from 'node:http'; - net (weak) Alignbase-sunpeak-afba9b7/examples/carousel-example/src/server.ts :1
import type { IncomingMessage } from 'node:http'; - net (weak) Alignbase-sunpeak-afba9b7/examples/map-example/src/server.ts :1
import type { IncomingMessage } from 'node:http'; - net (weak) Alignbase-sunpeak-afba9b7/examples/review-example/src/server.ts :1
import type { IncomingMessage } from 'node:http'; - net Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/inspect.mjs :24
import { createServer as createHttpServer } from 'http'; - net (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/test.mjs :207
const resp = await fetch(`http://localhost:${mcpPort}/health`, { - net Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/upgrade.mjs :23
const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`); - net Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/eval/eval-runner.mjs :87
const resp = await fetch(serverArg, { method: 'HEAD', redirect: 'follow' }); - net Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/get-port.mjs :1
import { createServer } from 'net'; - net Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/lib/sandbox-server.mjs :20
import { createServer } from 'http'; - net (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/scripts/validate.mjs :104
return fetch(url, { - net Alignbase-sunpeak-afba9b7/packages/sunpeak/src/inspector/inspector.tsx :676
const res = await fetch(endpoint);
show 6 more
- net Alignbase-sunpeak-afba9b7/packages/sunpeak/src/inspector/use-mcp-connection.ts :64
const res = await fetch(endpoint, { - net (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/mcp/oauth.test.ts :4
import { createServer, type Server } from 'node:http'; - net Alignbase-sunpeak-afba9b7/packages/sunpeak/src/mcp/production-server.ts :1
import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'; - net Alignbase-sunpeak-afba9b7/packages/sunpeak/src/mcp/server.ts :1
import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'; - net (weak) Alignbase-sunpeak-afba9b7/packages/sunpeak/src/mcp/stateless.test.ts :341
const res = await fetch(`http://localhost:${addr.port}/mcp`, { - net Alignbase-sunpeak-afba9b7/packages/sunpeak/template/src/server.ts :1
import type { IncomingMessage } from 'node:http';
install hooks 1
- prepublishOnly Alignbase-sunpeak-afba9b7/packages/sunpeak/package.json :149
pnpm build
obfuscation 1
- dynamic require()/import() Alignbase-sunpeak-afba9b7/packages/sunpeak/bin/commands/dev.mjs :449
const ResourceModule = await import(${safeSrcPath});