retry queued — source fetch failed — will retry
TypeScript and Rust monorepo: Claude Code and Pi coding-agent plugins, a minimal MCP stdio server framework, custom oxlint plugins and a pluggable Rust linter, policy-aware git tooling, core TS libraries, Wayland desktop apps (GTK4 file manager, Slint terminal, true-peak music player), OpenTofu infra automation, and a personal site.
Source not yet analyzed — this grade rests on attested signals (CVEs, supply-chain) only. It is a floor: reading the code could raise it, not lower it.
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 3d ago · see ecosystem CVEs →
- C · 56 → D · 64
No known CVEs for this server.
- high dangerous code
committed secret: Google API key, AWS access key id · dynamic exec: eval() · obfuscated payload: dynamic require()/import()
analyzed analyzer v33 · 5h ago
skills & prompt files 12
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/choosing-technology/SKILL.md
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/css/SKILL.md
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/dum-dum-non-ts/SKILL.md
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/project-code-review/SKILL.md
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/runbook/SKILL.md
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/source-audited-report/SKILL.md
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/testing-practices/SKILL.md
- skill Aquaticat-Monochromatic-5d3100b/.agents/skills/troubleshooting-doc/SKILL.md
- agent-rules Aquaticat-Monochromatic-5d3100b/AGENTS.md
- agent-rules Aquaticat-Monochromatic-5d3100b/CLAUDE.md
- agent-rules Aquaticat-Monochromatic-5d3100b/doc/limitation/claude.md
- agent-rules Aquaticat-Monochromatic-5d3100b/doc/philosophy/agents.md
danger signals6
- dynamic code execution eval() Aquaticat-Monochromatic-5d3100b/package-paused/dev-script/inference-canary/src/codegen/perf-test-data/mise.generate-expr-perf.ts :106
const evalResult = eval(evalStr,) as number; - committed secret Google API key Aquaticat-Monochromatic-5d3100b/package/cli/forbidden-strings/data/betterleaks-default-config.toml :1251
AIzaSy…(39 chars, redacted) - committed secret AWS access key id Aquaticat-Monochromatic-5d3100b/package/cli/forbidden-strings/data/builtin-rules.txt :111
AKIA22…(20 chars, redacted) - committed secret AWS access key id Aquaticat-Monochromatic-5d3100b/package/pi-plugin/auto-mode/src/signals.unit.test.ts :898
AKIA22…(20 chars, redacted) - committed secret AWS access key id Aquaticat-Monochromatic-5d3100b/package/rust-module/forbidden-regex.fuzz/fuzz_targets/fuzz_from_bytes.rs :18
AKIA01…(20 chars, redacted) - committed secret AWS access key id Aquaticat-Monochromatic-5d3100b/package/rust-module/forbidden-regex/tests/integration.rs :34
AKIA01…(20 chars, redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:Aquaticat/Monochromatic/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of Aquaticat.