MCP Observatory
1m ago Tracked 26,758 Last 1m ago 24h 1,572
github JavaScript analyzed f5578c7

BaiGanio/aperio

github

One brain. Every AI agent. Nothing forgotten. — Self-hosted memory layer via MCP + Postgres + pgvector

maintainer
BaiGanio
license
MIT
first seen
2026-06-08
last seen
2026-08-01
releases · 30d
7
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in BaiGanio/aperio
  2. HIGH code analysis flagged dynamic code execution in BaiGanio/aperio
  3. HIGH code analysis flagged dynamic code execution in BaiGanio/aperio
  4. HIGH code analysis flagged dynamic code execution in BaiGanio/aperio
  5. HIGH code analysis flagged dynamic code execution in BaiGanio/aperio
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f5578c7 · analyzer v28 · 3d ago

skills & prompt files 35

danger signals4

code evidence vv0.68.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 853

filesystem 75

  • fs BaiGanio-aperio-f5578c7/bootstrap.js :3 import { createWriteStream, existsSync, writeFileSync, readFileSync, mkdirSync } from 'fs';
  • fs BaiGanio-aperio-f5578c7/db/encrypt.js :23 import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync, statSync } from 'node:fs';
  • fs BaiGanio-aperio-f5578c7/db/migrate-sqlite.js :6 import { readdir, readFile } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/db/migrate.js :1 import { readdir, readFile } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/db/sqlite/encryption.js :7 import { copyFileSync, existsSync, renameSync, unlinkSync } from 'fs';
  • fs BaiGanio-aperio-f5578c7/db/sqlite/store.js :32 import { mkdirSync, existsSync } from 'fs';
  • fs BaiGanio-aperio-f5578c7/lib/agent/bundle.js :1 import { existsSync, readFileSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/agent/deliverables.js :9 import { writeFileSync, mkdirSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/agent/index.js :1 import { readFileSync, writeFileSync, existsSync, statSync, readdirSync, copyFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/agent/providers/codex.js :2 import { mkdirSync, readdirSync, renameSync, statSync, writeFileSync, unlinkSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/codegraph/backends/postgres.js :11 import { readFile, stat } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/lib/codegraph/backends/sqlite.js :14 import { readFile, stat } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/lib/codegraph/indexer.js :8 import { readdir, stat } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/lib/config-sync.js :16 import { readFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/context/artifactStore.js :20 } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/db-connect/sample-db.js :16 import { existsSync, mkdirSync, rmSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/db-connect/secrets.js :15 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/docgraph/backends/postgres.js :9 import { readFile, stat } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/lib/docgraph/backends/sqlite.js :17 import { readFile, stat } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/lib/docgraph/indexer.js :10 import { readdir, stat } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/lib/handlers/attachments/imageHandler.js :1 import { writeFileSync, mkdirSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/handlers/attachments/pdfHandler.js :2 import fs from "fs/promises";
  • fs BaiGanio-aperio-f5578c7/lib/handlers/codegraph/codegraphHandlers.js :9 import { readFile } from 'fs/promises';
  • fs BaiGanio-aperio-f5578c7/lib/handlers/data/dataHandlers.js :11 import { writeFileSync, readFileSync, existsSync } from 'node:fs';
  • fs BaiGanio-aperio-f5578c7/lib/helpers/artifactActions.js :2 import { statSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/artifactWorkspace.js :1 import { mkdir, readdir, rm, stat } from "node:fs/promises";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/capabilities.js :12 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/cliPrefs.js :6 import { existsSync, readFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/datasetLab.js :2 import { mkdir, readFile, writeFile } from "node:fs/promises";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/egressLog.js :6 import { appendFileSync, mkdirSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/envFile.js :11 import { readFileSync, writeFileSync, existsSync, chmodSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/ggufModelFacts.js :1 import { closeSync, existsSync, openSync, readSync, readdirSync, readFileSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/llamacpp/sessionLog.js :21 import { writeFileSync, existsSync, mkdirSync, openSync, closeSync, unlinkSync, statSync, readdirSync, readSync, appendFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/llamacppBinary.js :1 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/logger.js :3 import { mkdirSync, readdirSync, statSync, unlinkSync, appendFileSync, chmodSync } from 'fs';
  • fs BaiGanio-aperio-f5578c7/lib/helpers/minimalismBench.js :14 } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/minimalismLiveEval.js :6 import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/modelCache.js :18 import { readdirSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/modelProgress.js :29 import { readdirSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/modelTierDashboard.js :1 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/secureFile.js :7 import { writeFileSync, mkdirSync, chmodSync, existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/selfRestart.js :20 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/sessions.js :1 import { readFileSync, readdirSync, existsSync, unlinkSync, rmSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/specs.js :5 import { statfsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/spreadsheetPreview.js :1 import { statSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/startLlamaCpp.js :14 import { writeFileSync, readFileSync, existsSync, mkdirSync, openSync, closeSync, unlinkSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/helpers/tlsServer.js :10 import { readFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/load-env.js :14 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/pricing.js :9 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/routes/api-meta.js :4 import { readdirSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/routes/paths.js :3 import { realpathSync, existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/server.js :19 } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/server/browser.js :4 import { mkdirSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/server/locale.js :6 import { readFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/services/folder-indexing.js :1 import { existsSync, realpathSync, statSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/terminal.js :28 import { realpathSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/terminal/attachments.js :6 import { existsSync, readFileSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/terminal/strings.js :17 import { readFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/tools/schemaCheck.js :18 import { appendFileSync, mkdirSync, existsSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/lib/tools/validateWrittenFile.js :17 import { existsSync, readFileSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/workers/agent-scheduler.js :21 import { readFileSync, existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/workers/roundtable.js :2 import { writeFileSync, appendFileSync, existsSync, mkdirSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/workers/skills/loader.js :5 import { readFileSync, readdirSync, existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/lib/workers/skills/overlay.js :5 import { writeFileSync, existsSync, mkdirSync, rmSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/files/delete.js :4 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/files/generate.js :3 import fs from "fs/promises";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/files/interrupt.js :15 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/files/perform.js :5 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/files/read.js :4 import { readFileSync, readdirSync, statSync, lstatSync, existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/files/write.js :5 import { existsSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/image.js :12 import { readFileSync, existsSync, statSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/mcp/tools/shell.js :4 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/server.js :1 import { existsSync, statSync, chmodSync } from "fs";
  • fs BaiGanio-aperio-f5578c7/skills/autotune/calibrate.mjs :22 import { readFileSync } from "node:fs";
  • fs BaiGanio-aperio-f5578c7/skills/autotune/score.mjs :22 import { readFileSync, existsSync, appendFileSync, mkdirSync } from "node:fs";

shell / exec 27

  • shell BaiGanio-aperio-f5578c7/bootstrap.js :2 import { spawn, execSync, exec } from 'child_process';
  • shell BaiGanio-aperio-f5578c7/db/encrypt.js :24 import { execSync, execFileSync } from 'node:child_process';
  • shell BaiGanio-aperio-f5578c7/db/index.js :9 import { spawnSync } from "child_process";
  • shell BaiGanio-aperio-f5578c7/db/self-memory-seed.js :79 "bootstrap.js downloads a pinned, checksum-verified llama-server release per OS straight into ./vendor/llamacpp: macOS gets the arm64/Metal build, Windows and Linux both get Vulkan builds (broadest si
  • shell BaiGanio-aperio-f5578c7/db/sqlite/search.js :25 // Tags is JSON array; require *any* match (matches Postgres `tags && $`).
  • shell BaiGanio-aperio-f5578c7/db/wiki-seed.js :980 \`PATH\` so the app's own \`spawn('llama-server')\` finds it. Models are separate: the engine
  • shell BaiGanio-aperio-f5578c7/lib/agent/providers/codex.js :1 import { spawn as nodeSpawn } from "node:child_process";
  • shell BaiGanio-aperio-f5578c7/lib/docgraph/extract-facts.js :82 if ((m = raw.match(new RegExp(`^(${MONTH_RE_SRC})[a-z]*\\.?\\s+(\\d{1,2}),?\\s+(\\d{4})$`, "i")))) {
  • shell BaiGanio-aperio-f5578c7/lib/helpers/artifactActions.js :1 import { execFile } from "node:child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/capabilities.js :13 import { execFileSync, execFile } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/completion.js :8 import { execFile } from 'node:child_process';
  • shell BaiGanio-aperio-f5578c7/lib/helpers/ensurePort.js :11 import { execSync } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/envFile.js :26 // always wrap in quotes so spaces/`#`/`$` stay literal.
  • shell BaiGanio-aperio-f5578c7/lib/helpers/hardware.js :8 import { execFileSync } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/metricsSampler.js :11 import { exec } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/minimalismBench.js :18 import { spawnSync } from "node:child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/minimalismLiveEval.js :7 import { spawn } from "node:child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/selfRestart.js :19 import { spawn } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/helpers/startLlamaCpp.js :13 import { spawn, execFileSync } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/routes/api-meta.js :6 import { exec } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/server/browser.js :6 import { execFile } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/terminal/signals.js :8 import { spawn } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/tools/validateWrittenFile.js :19 import { spawn } from "child_process";
  • shell BaiGanio-aperio-f5578c7/lib/utils/chat-utils.js :200 const out = execSync("lsof", ["-ti", `tcp:${port}`], {
  • shell BaiGanio-aperio-f5578c7/mcp/tools/github.js :5 import { execFile } from "child_process";
  • shell BaiGanio-aperio-f5578c7/mcp/tools/shell.js :2 import { spawn } from "child_process";
  • shell BaiGanio-aperio-f5578c7/skills/autotune/score.mjs :23 import { execSync } from "node:child_process";

network 19

  • net BaiGanio-aperio-f5578c7/bootstrap.js :6 import net from 'net';
  • net BaiGanio-aperio-f5578c7/lib/agent/providers/deepseek.js :19 const response = await fetch(`${provider.baseURL}/chat/completions`, {
  • net BaiGanio-aperio-f5578c7/lib/agent/providers/llamacpp.js :120 const h = await fetch(`${provider.llamacppBaseURL}/health`, { signal: AbortSignal.any([c.signal, AbortSignal.timeout(timeout)]) });
  • net BaiGanio-aperio-f5578c7/lib/handlers/wiki/regenerate.js :67 const r = await fetch(`${base}/v1/chat/completions`, {
  • net BaiGanio-aperio-f5578c7/lib/helpers/completion.js :119 const res = await fetch(`${provider.baseURL}/chat/completions`, {
  • net BaiGanio-aperio-f5578c7/lib/helpers/embeddings.js :203 const res = await fetch("https://api.voyageai.com/v1/embeddings", {
  • net BaiGanio-aperio-f5578c7/lib/helpers/ensurePort.js :10 import { createServer } from "net";
  • net BaiGanio-aperio-f5578c7/lib/helpers/llamacpp/models.js :12 const r = await fetch(`${LLAMACPP_BASE_URL}/models`, { signal: AbortSignal.timeout(3000) });
  • net BaiGanio-aperio-f5578c7/lib/helpers/modelProgress.js :102 const r = await fetch(`${routerBaseURL}/models`, { signal: AbortSignal.timeout(STATUS_TIMEOUT) });
  • net BaiGanio-aperio-f5578c7/lib/helpers/ssrfGuard.js :17 import net from "node:net";
  • net BaiGanio-aperio-f5578c7/lib/helpers/startLlamaCpp.js :52 const r = await fetch(`${LLAMACPP_BASE_URL}/health`, { signal: AbortSignal.timeout(1000) });
  • net BaiGanio-aperio-f5578c7/lib/helpers/tlsServer.js :8 import { createServer as createHttpServer } from "http";
  • net BaiGanio-aperio-f5578c7/lib/pricing.js :55 const res = await fetch(url);
  • net BaiGanio-aperio-f5578c7/lib/routes/api-meta.js :204 const r = await fetch(`${llamacppBase}/v1/models`, { signal: AbortSignal.timeout(3000) });
  • net BaiGanio-aperio-f5578c7/lib/terminal/ui.js :220 const schema = await fetch(`http://localhost:${port}/api/config/schema`).then((r) => r.json());
  • net BaiGanio-aperio-f5578c7/lib/utils/chat-utils.js :1 import net from "net";
  • net BaiGanio-aperio-f5578c7/mcp/tools/github.js :104 const resp = await fetch(`${API_BASE}/repos/${owner}/${repo}/issues/${number}`, {
  • net BaiGanio-aperio-f5578c7/mcp/tools/image.js :84 const r = await fetch(`${LLAMACPP_BASE_URL}/v1/chat/completions`, {
  • net BaiGanio-aperio-f5578c7/mcp/tools/web.js :109 const response = await fetch(endpoint, {

secrets 10

  • secrets BaiGanio-aperio-f5578c7/db/postgres/store.js :28 export function assertNonDefaultDbUrl(url, allow = process.env.APERIO_ALLOW_DEFAULT_DB_PASSWORD) {
  • secrets BaiGanio-aperio-f5578c7/lib/handlers/wiki/regenerate.js :83 if (!process.env.DEEPSEEK_API_KEY) throw new Error("DEEPSEEK_API_KEY missing");
  • secrets BaiGanio-aperio-f5578c7/lib/helpers/authGuard.js :15 const t = process.env.APERIO_AUTH_TOKEN;
  • secrets BaiGanio-aperio-f5578c7/lib/helpers/embeddings.js :176 if (!process.env.VOYAGE_API_KEY) {
  • secrets BaiGanio-aperio-f5578c7/lib/helpers/sessionCrypto.js :25 const secret = process.env.APERIO_SESSION_KEY;
  • secrets BaiGanio-aperio-f5578c7/lib/helpers/staticAuth.js :26 if (process.env.APERIO_AUTH_TOKEN && isAuthorized(req)) return next();
  • secrets BaiGanio-aperio-f5578c7/lib/providers/index.js :340 if (PROVIDER === "deepseek") { const model = overrides.model || process.env.DEEPSEEK_MODEL; return { name: "deepseek", model, baseURL: "https://api.deepseek.com/v1", apiKey: process.env.DEEPSEEK_API_K
  • secrets BaiGanio-aperio-f5578c7/lib/routes/api-github-webhook.js :31 const secret = (fromSettings != null && String(fromSettings).trim()) || process.env.GITHUB_WEBHOOK_SECRET;
  • secrets BaiGanio-aperio-f5578c7/lib/routes/api-meta.js :210 if (process.env.ANTHROPIC_API_KEY) {
  • secrets BaiGanio-aperio-f5578c7/mcp/tools/github.js :21 function githubHeaders(token = process.env.GITHUB_TOKEN) {

database 7

  • db BaiGanio-aperio-f5578c7/db/migrate.js :4 import pg from 'pg';
  • db BaiGanio-aperio-f5578c7/db/postgres/store.js :5 import pg from 'pg';
  • db BaiGanio-aperio-f5578c7/db/sqlite/encryption.js :6 import Database from 'better-sqlite3';
  • db BaiGanio-aperio-f5578c7/db/sqlite/store.js :29 import Database from 'better-sqlite3';
  • db BaiGanio-aperio-f5578c7/lib/db-connect/drivers/postgres.js :14 import pg from "pg";
  • db BaiGanio-aperio-f5578c7/lib/db-connect/drivers/sqlite.js :13 import Database from "better-sqlite3";
  • db BaiGanio-aperio-f5578c7/lib/db-connect/sample-db.js :15 import Database from "better-sqlite3";

declared dependencies 40

  • @modelcontextprotocol/sdk@^1.29.0
  • @anthropic-ai/claude-agent-sdk@^0.3.220
  • @anthropic-ai/sdk@^0.115.0
  • @google/generative-ai@^0.24.1
  • @huggingface/transformers@^4.2.0
  • adm-zip@^0.6.0
  • better-sqlite3@^13.0.1
  • chokidar@^5.0.0
  • d3@7.9.0
  • docx@^9.7.1
  • dotenv@^17.4.2
  • emphasize@^7.0.0
  • exceljs@^4.4.0
  • express@^5.2.1
  • express-rate-limit@^8.6.0
  • fast-xml-parser@^5.10.1
  • gpt-tokenizer@^3.4.0
  • graphology@^0.26.0
  • graphology-communities-louvain@^2.0.2
  • helmet@^8.3.0
  • mammoth@^1.12.0
  • mssql@^12.7.0
  • mysql2@^3.23.1
  • open@^11.0.0
  • pdf-lib@^1.17.1
  • pdfjs-dist@^6.1.200
  • pg@^8.22.0
  • pptxgenjs@^4.0.1
  • sanitize-html@^2.17.6
  • sharp@^0.35.3
  • sqlite-vec@^0.1.9
  • tree-sitter-wasms@^0.1.13
  • uuid@^14.0.1
  • web-tree-sitter@^0.24.7
  • winston@^3.19.0
  • winston-daily-rotate-file@^5.0.0
  • ws@^8.21.1
  • zod@^4.4.3
  • @playwright/test@^1.62.0
  • c8@^12.0.0

obfuscation 3

  • dynamic require()/import() BaiGanio-aperio-f5578c7/lib/server/graphWatchers.js :24 const { [AVAILABILITY_CHECK[kind]]: isAvailable } = await import(`../${kind}/indexer.js`);
  • dynamic require()/import() BaiGanio-aperio-f5578c7/lib/workers/skills/execution.js :142 const module = await import(`file://${scriptPath}`);
  • dynamic require()/import() BaiGanio-aperio-f5578c7/tests/integration/mcp/index.test.js :165 const { startServer } = await import(${JSON.stringify(mcpIndexUrl)});

perm:untrusted 1

  • untrusted BaiGanio-aperio-f5578c7/lib/terminal/ui.js :220 const schema = await fetch(`http://localhost:${port}/api/config/schema`).then((r) => r.json());