Self-hosted MCP backplane for agent-built internal apps: AI coding agents ship apps that inherit compute, data, secrets and identity — no credentials, governed and audited.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 301dcca · analyzer v33 · 5d ago
skills & prompt files 10
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/bh-admin-alice.md
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/bh-admin-bob.md
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/bh-builder-carol.md
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/bh-builder-dave.md
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/bh-user-erin.md
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/bh-user-frank.md
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/release-guardian.md
- agent-rules Beamhall-beamhall-301dcca/.claude/agents/website-steward.md
- skill Beamhall-beamhall-301dcca/.claude/skills/bh-conformance/SKILL.md
- agent-rules Beamhall-beamhall-301dcca/CLAUDE.md
danger signals1
- committed secret OpenAI key Beamhall-beamhall-301dcca/internal/secret/heuristics_test.go :17
sk-pro…(27 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 239
filesystem 2
- fs Beamhall-beamhall-301dcca/demo/beam-app/server.js :15
const fs = require("fs"); - fs Beamhall-beamhall-301dcca/website/integrations/original-presentation.mjs :2
import { readFileSync } from "node:fs";
network 1
- net Beamhall-beamhall-301dcca/demo/beam-app/server.js :14
const http = require("http");
database 1
- db Beamhall-beamhall-301dcca/demo/beam-app/server.js :32
const { Pool } = require("pg");
declared dependencies 93
- github.com/modelcontextprotocol/go-sdk@v1.6.1
- @astrojs/sitemap@^3.7.3
- astro@^6.4.8
- sharp@^0.34.0
- filippo.io/age@v1.3.1
- github.com/docker/docker@v28.5.2+incompatible
- github.com/emersion/go-sasl@v0.0.0-20241020182733-b788ff22d5a6
- github.com/emersion/go-smtp@v0.24.0
- github.com/go-git/go-billy/v5@v5.9.0
- github.com/go-git/go-git/v5@v5.19.1
- github.com/golang-jwt/jwt/v5@v5.3.1
- github.com/jackc/pgx/v5@v5.10.0
show 28 more
- github.com/johannesboyne/gofakes3@v0.0.0-20260208201424-4c385a1f6a73
- github.com/minio/minio-go/v7@v7.2.1
- github.com/oklog/ulid/v2@v2.1.1
- golang.org/x/sync@v0.20.0
- golang.org/x/time@v0.15.0
- modernc.org/sqlite@v1.52.0
- dario.cat/mergo@v1.0.0
- filippo.io/hpke@v0.4.0
- github.com/Microsoft/go-winio@v0.6.2
- github.com/ProtonMail/go-crypto@v1.1.6
- github.com/cespare/xxhash/v2@v2.3.0
- github.com/cloudflare/circl@v1.6.3
- github.com/containerd/errdefs@v1.0.0
- github.com/containerd/errdefs/pkg@v0.3.0
- github.com/containerd/log@v0.1.0
- github.com/cyphar/filepath-securejoin@v0.6.1
- github.com/distribution/reference@v0.6.0
- github.com/docker/go-connections@v0.7.0
- github.com/docker/go-units@v0.5.0
- github.com/dustin/go-humanize@v1.0.1
- github.com/emirpasic/gods@v1.18.1
- github.com/felixge/httpsnoop@v1.0.4
- github.com/go-git/gcfg@v1.5.1-0.20230307220236-3a3c6141e376
- github.com/go-logr/logr@v1.4.3
- github.com/go-logr/stdr@v1.2.2
- github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8
- github.com/google/jsonschema-go@v0.4.3
- github.com/google/uuid@v1.6.0
53 more not shown — this panel samples each group; the count above is the real total.