MCP Observatory
3m ago Tracked 59,469 Last 3m ago 24h 2,466
github TypeScript re-analysis due

AndrewAvery7/promptspend

github

LLM pricing that shows its work: every price carries its source and the date it was last confirmed, re-checked against the vendors every morning. A web calculator, an MCP server, a VS Code extension and a free keyless API.

maintainer
AndrewAvery7
licence
MIT
first seen
2026-08-05
last seen
2026-09-17
releases · 30d
1
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit cc2f387 · analyzer v33 · 1w ago

skills & prompt files 2

code evidence vv0.7.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 325

filesystem 43

  • fs AndrewAvery7-promptspend-cc2f387/apps/mobile/plugins/with-android-data-protection.js :2 const fs = require('node:fs');
  • fs (weak) AndrewAvery7-promptspend-cc2f387/apps/mobile/scripts/audit-triage.mjs :42 import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/apps/mobile/scripts/check-release.mjs :1 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/apps/mobile/scripts/prepare-associated-domain-files.mjs :1 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/mcp/src/fetch.test.ts :18 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/mcp/src/tools.test.ts :1 import { readFile } from 'node:fs/promises';
  • fs AndrewAvery7-promptspend-cc2f387/mcp/tools/check-footprint.ts :21 import { readFileSync } from 'node:fs';
  • fs AndrewAvery7-promptspend-cc2f387/mcp/tools/check-startup.ts :23 import { existsSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/build-pages.ts :19 import { existsSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-bundle-budget.ts :15 import { readdir, readFile, stat } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-csp.ts :18 import { readFile } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-encoding.ts :33 import { readFileSync, statSync } from 'node:fs';
show 28 more
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-pages.ts :36 import { readFile, writeFile } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-receipt.ts :2 import { existsSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-seo.ts :14 import { readFile, readdir } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-social-card.ts :23 import { readFile } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-test-badge.ts :37 import { existsSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/notify-alerts.ts :22 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/ping-indexnow.ts :26 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/sync-pricing.ts :20 import { readFile, writeFile, appendFile, mkdir } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/validate-catalog.ts :5 import { readFile } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/scripts/verify-vendors.ts :38 import { appendFile, mkdir, readFile, writeFile } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/src/lib/contrast.test.ts :1 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/src/lib/select/cheaper.test.ts :2 import { readFileSync } from 'node:fs';
  • fs AndrewAvery7-promptspend-cc2f387/tools/capture-ui.ts :19 import { mkdir } from 'node:fs/promises';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vite.config.ts :5 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/catalog.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/ceiling.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/comments.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/diagnose.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/estimate.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/fetch.test.ts :15 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/inventory.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/present.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/scan.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/service.test.ts :2 import { readFileSync } from 'node:fs';
  • fs AndrewAvery7-promptspend-cc2f387/vscode/src/tree.ts :4 * The sweep reads files with `workspace.fs.readFile` rather than
  • fs (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/vendor-ids.test.ts :2 import { readFileSync } from 'node:fs';
  • fs AndrewAvery7-promptspend-cc2f387/vscode/tools/build.ts :26 import { readFileSync } from 'node:fs';
  • fs AndrewAvery7-promptspend-cc2f387/vscode/tools/check-activation.ts :25 import { readFileSync } from 'node:fs';

3 more not shown — this panel samples each group; the count above is the real total.

shell / exec 7

  • shell (weak) AndrewAvery7-promptspend-cc2f387/apps/mobile/scripts/audit-triage.mjs :41 import { spawnSync } from 'node:child_process';
  • shell AndrewAvery7-promptspend-cc2f387/mcp/tools/check-startup.ts :22 import { spawn } from 'node:child_process';
  • shell (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-encoding.ts :32 import { execFileSync } from 'node:child_process';
  • shell (weak) AndrewAvery7-promptspend-cc2f387/scripts/check-test-badge.ts :36 import { spawn } from 'node:child_process';
  • shell (weak) AndrewAvery7-promptspend-cc2f387/scripts/notify-alerts.ts :21 import { execFileSync } from 'node:child_process';
  • shell (weak) AndrewAvery7-promptspend-cc2f387/scripts/ping-indexnow.ts :27 import { execFileSync } from 'node:child_process';
  • shell AndrewAvery7-promptspend-cc2f387/vscode/tools/check-package.ts :28 import { execFileSync, execSync } from 'node:child_process';

network 19

  • net AndrewAvery7-promptspend-cc2f387/api/src/catalog.ts :37 * shipped: in Workers, `caches.default` and the cache behind `fetch()` are the
  • net (weak) AndrewAvery7-promptspend-cc2f387/api/src/index.test.ts :136 const get = (path: string, headers: Record<string, string> = {}) => SELF.fetch(`${API}${path}`, { headers });
  • net AndrewAvery7-promptspend-cc2f387/api/src/index.ts :78 async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
  • net AndrewAvery7-promptspend-cc2f387/apps/mobile/src/lib/emailAlerts.ts :52 response = await fetch(`${ALERTS_API_URL}${path}`, {
  • net AndrewAvery7-promptspend-cc2f387/mcp/src/catalog.ts :83 const response = await fetch(url, { cache: 'no-store', signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
  • net (weak) AndrewAvery7-promptspend-cc2f387/mcp/src/fetch.test.ts :17 import { createServer, type Server } from 'node:http';
  • net AndrewAvery7-promptspend-cc2f387/packages/core/src/pricing/catalog.ts :285 const response = await fetch(url, { cache: 'no-cache' });
  • net AndrewAvery7-promptspend-cc2f387/public/sw.js :111 await fetch(`${apiOrigin}/v1/push/subscribe`, {
  • net (weak) AndrewAvery7-promptspend-cc2f387/scripts/notify-alerts.ts :93 const response = await fetch(`${api}/v1/notify`, {
  • net (weak) AndrewAvery7-promptspend-cc2f387/scripts/sync-pricing.ts :97 const response = await fetch(url, {
  • net (weak) AndrewAvery7-promptspend-cc2f387/scripts/verify-vendors.ts :104 return await fetch(url, { ...init, signal: controller.signal });
  • net AndrewAvery7-promptspend-cc2f387/src/lib/alerts/api.ts :38 response = await fetch(`${ALERTS_API}${path}`, {
show 7 more
  • net AndrewAvery7-promptspend-cc2f387/vscode/src/catalog.ts :88 const response = await fetch(url, { cache: 'no-store' });
  • net (weak) AndrewAvery7-promptspend-cc2f387/vscode/src/fetch.test.ts :14 import { createServer, type Server } from 'node:http';
  • net AndrewAvery7-promptspend-cc2f387/worker/src/email/transport.ts :58 response = await fetch(
  • net (weak) AndrewAvery7-promptspend-cc2f387/worker/src/index.test.ts :25 return SELF.fetch(`${API}${path}`, {
  • net AndrewAvery7-promptspend-cc2f387/worker/src/index.ts :78 async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
  • net AndrewAvery7-promptspend-cc2f387/worker/src/lib/turnstile.ts :42 const response = await fetch(VERIFY_URL, { method: 'POST', body });
  • net AndrewAvery7-promptspend-cc2f387/worker/src/push/send.ts :58 response = await fetch(target.endpoint, {

secrets 3

  • secrets AndrewAvery7-promptspend-cc2f387/playwright.config.ts :76 VITE_TURNSTILE_SITE_KEY: process.env.VITE_TURNSTILE_SITE_KEY ?? '',
  • secrets (weak) AndrewAvery7-promptspend-cc2f387/scripts/notify-alerts.ts :56 const secret = process.env.NOTIFY_SECRET ?? '';
  • secrets (weak) AndrewAvery7-promptspend-cc2f387/scripts/verify-vendors.ts :129 const firecrawlKey = process.env.FIRECRAWL_API_KEY;

install hooks 2

  • prepublishOnly AndrewAvery7-promptspend-cc2f387/mcp/package.json :37 npm run verify
  • prepack AndrewAvery7-promptspend-cc2f387/mcp/package.json :38 npm run build

declared dependencies 30

  • @fontsource/ibm-plex-sans@^5.3.0
  • @fontsource/jetbrains-mono@^5.3.0
  • @fontsource/space-grotesk@^5.3.0
  • js-tiktoken@^1.0.15
  • react@^18.3.1
  • react-dom@^18.3.1
  • @anthropic-ai/sdk@^0.124.0
  • @axe-core/playwright@^4.13.0
  • @eslint/js@^9.39.5
  • @playwright/test@^1.62.1
  • @promptspend/core@file:packages/core
  • @testing-library/dom@^10.4.1
show 18 more
  • @testing-library/jest-dom@^7.0.1
  • @testing-library/react@^16.1.0
  • @testing-library/user-event@^14.6.4
  • @types/node@^22.20.1
  • @types/react@^18.3.12
  • @types/react-dom@^18.3.1
  • @vitejs/plugin-react@^4.3.4
  • @vitest/coverage-v8@^4.1.10
  • eslint@^9.17.0
  • eslint-plugin-react-hooks@^7.1.1
  • globals@^17.11.0
  • jsdom@^30.0.1
  • prettier@^3.4.2
  • tsx@^4.23.12
  • typescript@^5.7.2
  • typescript-eslint@^8.67.0
  • vite@^6.0.5
  • vitest@^4.1.10

clipboard 1

  • navigator.clipboard AndrewAvery7-promptspend-cc2f387/tests/e2e/receipt.spec.ts :31 const clipboard = await page.evaluate(() => navigator.clipboard.readText());

ide-extension 1

  • untrusted-exec (medium) AndrewAvery7-promptspend-cc2f387/vscode/package.json runs its entry point in untrusted workspaces (untrustedWorkspaces.supported)

perm:untrusted 1

  • untrusted (weak) AndrewAvery7-promptspend-cc2f387/worker/src/index.test.ts :60 const body = (await (await SELF.fetch(`${API}/v1/config`)).json()) as Record<string, unknown>;