github TypeScript re-analysis due

BeatAPI/BeatDesign

github

Local-first AI canvas and timeline. Any MCP agent. Open-source alternative to Higgsfield.

maintainer: BeatAPI
license: Apache-2.0
first seen: 2026-09-02
last seen: 2026-09-04
releases · 30d: 3
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 26 tools

transport stdio · http counts 26 tools · 0 res · 0 prompts permission surface via code analysis

tools

bdesign_asset_extract_frame
bdesign_asset_get
bdesign_asset_import
bdesign_asset_list
bdesign_canvas_apply
bdesign_canvas_continue_from_tail
bdesign_canvas_get
bdesign_canvas_search
bdesign_canvas_view
bdesign_editor_diagnostics
bdesign_editor_edit
bdesign_editor_get
bdesign_editor_history
bdesign_editor_import_srt
bdesign_editor_snapshot
bdesign_editor_view
bdesign_generation_history
bdesign_generation_model_get
bdesign_generation_models
bdesign_generation_status
bdesign_generation_submit
bdesign_project_create
bdesign_project_get
bdesign_project_list
bdesign_project_open
bdesign_project_target

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit ad7569e · analyzer v33 · 12h ago

skills & prompt files 5

danger signals2

suspicious endpoint 8.8.8.8 BeatAPI-BeatDesign-ad7569e/src/core/effects/beatapi-media-url.test.ts :14 'https://8.8.8.8:8443/output.webm',
suspicious endpoint 169.254.169.254 (cloud metadata) BeatAPI-BeatDesign-ad7569e/src/core/workspace-storage/endpoint-policy.test.ts :16 'https://169.254.169.254',

code evidence vv0.2.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 373

filesystem 48

fs (weak) BeatAPI-BeatDesign-ad7569e/scripts/check-i18n.mjs :3 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/scripts/db-setup.mjs :2 import { copyFileSync, existsSync } from "node:fs";
fs (weak) BeatAPI-BeatDesign-ad7569e/scripts/mcp-server.ts :3 import { realpathSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/scripts/run-tests.mjs :2 import { globSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/scripts/sanitize-output.mjs :1 import { readdir, readFile, stat, writeFile } from 'node:fs/promises';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/app/create-project-route-page.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/app/product-page-shell-title.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/app/product-page-shell.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/beatcanvas-card-connector-overlay-copy.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/beatcanvas-front-layer-toolbar.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/beatcanvas-shell.suspense.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/beatcanvas-sidebar.lazy-panels.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/nodes/asset-card-node-preview.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/nodes/generation-card-node-interaction.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/react-flow/beatcanvas-reference-edge.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/react-flow/react-flow-editor.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/use-beatcanvas-react-flow-adapter.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/use-project-snapshot-lifecycle.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/home/workspace-page.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/marketing/beatapi-product-home.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/marketing/beatapi-product-shell.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/components/studio/beat-studio-workspace.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/config/database-defaults.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/config/paraglide.test.ts :2 import { access, mkdtemp, readFile, rm } from 'node:fs/promises';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/core/effects/generation-provider-client-boundary.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/core/generation-providers/registry.test.ts :2 import { readFileSync } from 'node:fs';
fs BeatAPI-BeatDesign-ad7569e/src/core/generation-providers/submit.ts :1 import { readFile, stat } from 'node:fs/promises';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/core/media/extract-video-frame-file.test.ts :3 import { mkdtemp, rm } from 'node:fs/promises';
fs BeatAPI-BeatDesign-ad7569e/src/core/media/extract-video-frame-file.ts :2 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
fs BeatAPI-BeatDesign-ad7569e/src/core/projects/import-local-asset.ts :1 import { readFile, stat } from 'node:fs/promises';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/core/projects/local-project-assets.test.ts :2 import { mkdtemp, readFile, rm, symlink } from 'node:fs/promises';
fs BeatAPI-BeatDesign-ad7569e/src/core/projects/local-project-assets.ts :2 import { lstatSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/lib/api-error-surface.test.ts :2 import { readFile, readdir } from 'node:fs/promises';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/lib/crypto.test.ts :2 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/lib/i18n-ui-copy-regression.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/cwd-independence.test.ts :3 import { existsSync, mkdtempSync, rmSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/integration-templates.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/server.contract.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/server.runtime.test.ts :2 import { readFileSync } from 'node:fs';
fs BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :1 import { readFile, stat } from 'node:fs/promises';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/stdio-probe.test.ts :3 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/routes/(pages)/-static-page-content.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/routes/-workspace-project-route.client-boundary.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/routes/api/-trusted-mutations.contract.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/routes/api/app/-recent-assets.project-scope.test.ts :2 import { readFileSync } from 'node:fs';
fs BeatAPI-BeatDesign-ad7569e/src/routes/api/app/projects/$projectId/assets/$assetId.ts :2 import { createReadStream } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/routes/api/config/-beatapi-config.contract.test.ts :2 import { readFileSync } from 'node:fs';
fs (weak) BeatAPI-BeatDesign-ad7569e/src/routes/api/config/-storage-config.contract.test.ts :2 import { readFileSync } from 'node:fs';

shell / exec 8

shell (weak) BeatAPI-BeatDesign-ad7569e/scripts/dev-with-mcp.mjs :2 import { spawn } from 'node:child_process';
shell (weak) BeatAPI-BeatDesign-ad7569e/scripts/mcp-server.ts :2 import { spawn } from 'node:child_process';
shell (weak) BeatAPI-BeatDesign-ad7569e/scripts/run-tests.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) BeatAPI-BeatDesign-ad7569e/src/core/media/extract-video-frame-file.test.ts :2 import { execFileSync, spawnSync } from 'node:child_process';
shell BeatAPI-BeatDesign-ad7569e/src/core/media/extract-video-frame-file.ts :1 import { spawn } from 'node:child_process';
shell (weak) BeatAPI-BeatDesign-ad7569e/src/lib/crypto.test.ts :5 import { spawnSync } from 'node:child_process';
shell (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/cwd-independence.test.ts :2 import { spawn } from 'node:child_process';
shell (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/stdio-probe.test.ts :2 import { spawn } from 'node:child_process';

network 17

net (weak) BeatAPI-BeatDesign-ad7569e/scripts/dev-with-mcp.mjs :15 const response = await fetch('http://127.0.0.1:3020/api/ping', {
net (weak) BeatAPI-BeatDesign-ad7569e/scripts/localize-project-media.ts :56 const response = await fetch(providerUrl, {
net BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/beatcanvas-shell.tsx :1172 let response = await fetch(downloadUrl);
net BeatAPI-BeatDesign-ad7569e/src/components/beatcanvas/use-project-snapshot-lifecycle.ts :259 fetch(`/api/app/projects/${projectId}/snapshot`, {
net BeatAPI-BeatDesign-ad7569e/src/components/editor/video-editor-workspace.tsx :762 void fetch(
net BeatAPI-BeatDesign-ad7569e/src/core/adapters/beatapi-adapter.ts :642 const response = await fetch(`${config.baseUrl}${path}`, {
net BeatAPI-BeatDesign-ad7569e/src/core/editor/media-export.ts :133 const response = await fetch(source.sourceUrl, { signal });
net BeatAPI-BeatDesign-ad7569e/src/core/effects/beatapi-input-upload.ts :54 const response = await fetch(`${baseUrl}/v1/files`, {
net BeatAPI-BeatDesign-ad7569e/src/core/effects/client-api.ts :75 const response = await fetch('/api/effects/precheck', {
net BeatAPI-BeatDesign-ad7569e/src/core/effects/output-storage.ts :143 const response = await fetch(url, {
net BeatAPI-BeatDesign-ad7569e/src/lib/api-client.ts :33 const res = await fetch(url, {
net (weak) BeatAPI-BeatDesign-ad7569e/src/mcp/http-server.test.ts :2 import type { Server } from 'node:http';
net BeatAPI-BeatDesign-ad7569e/src/mcp/http-server.ts :1 import { createServer, type IncomingMessage, type Server } from 'node:http';
net BeatAPI-BeatDesign-ad7569e/src/routes/api/assets/download.ts :104 const upstream = await fetch(assetUrl, {
net BeatAPI-BeatDesign-ad7569e/src/routes/api/config/beatapi.ts :58 const testResponse = await fetch(`${DEFAULT_BEATAPI_BASE_URL}/v1/usage`, {
net BeatAPI-BeatDesign-ad7569e/src/routes/api/storage/upload.ts :75 const response = await fetch(
net BeatAPI-BeatDesign-ad7569e/src/server.ts :10 async fetch(req: Request): Promise<Response> {

secrets 1

secrets BeatAPI-BeatDesign-ad7569e/src/mcp/http-server.ts :124 const token = options.token ?? process.env.BEATDESIGN_MCP_TOKEN?.trim();

tool registrations 26

bdesign_project_list BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :292
bdesign_project_get BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :307
bdesign_project_create BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :343
bdesign_project_target BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :361
bdesign_project_open BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :395
bdesign_asset_list BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :425
bdesign_asset_get BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :441
bdesign_asset_import BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :459
bdesign_asset_extract_frame BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :476
bdesign_canvas_get BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :498
bdesign_canvas_view BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :521
bdesign_canvas_search BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :561
bdesign_canvas_apply BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :591
bdesign_canvas_continue_from_tail BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :612
bdesign_generation_models BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :653
bdesign_generation_model_get BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :665
bdesign_generation_submit BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :679
bdesign_generation_status BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :706
bdesign_generation_history BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :739
bdesign_editor_get BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :755
bdesign_editor_edit BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :768
bdesign_editor_import_srt BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :788
bdesign_editor_snapshot BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :836
bdesign_editor_diagnostics BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :855
bdesign_editor_view BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :873
bdesign_editor_history BeatAPI-BeatDesign-ad7569e/src/mcp/server.ts :898

install hooks 1

postinstall BeatAPI-BeatDesign-ad7569e/package.json :33 mkdir -p data && (test -f src/config/db/schema.ts || node scripts/db-setup.mjs)

declared dependencies 46

@modelcontextprotocol/server@^2.0.0
@aws-sdk/client-s3@^3.1069.0
@aws-sdk/s3-request-presigner@^3.1069.0
@base-ui/react@^1.3.0
@fontsource-variable/figtree@^5.3.0
@fontsource-variable/geist-mono@^5.3.0
@fontsource-variable/space-grotesk@^5.3.0
@libsql/client@^0.14.0
@mdx-js/react@^3.1.1
@tanstack/react-query@^5.101.0
@tanstack/react-router@1.170.11
@tanstack/react-start@1.168.19
@types/mdx@^2.0.13
@xyflow/react@12.11.2
class-variance-authority@^0.7.1
clsx@^2.1.0
drizzle-orm@^0.45.2
jszip@^3.10.1
lucide-react@^0.511.0
mediabunny@1.25.3
next-themes@^0.4.6
react@^19.2.1
react-dom@^19.2.1
s3mini@^0.9.5
simple-flakeid@^0.0.5
sonner@^2.0.7
tailwind-merge@^3.3.1
tw-animate-css@^1.4.0
uuid@^13.0.0
zod@^4.3.6
@inlang/paraglide-js@^2.18.2
@mdx-js/rollup@^3.1.1
@tailwindcss/vite@^4.3.0
@tanstack/react-query-devtools@^5.101.0
@types/node@^22.0.0
@types/react@^19.1.0
@types/react-dom@^19.1.0
@vitejs/plugin-react@^6.0.2
drizzle-kit@^0.31.4
nitro@3.0.260603-beta
rollup@4.62.4
shadcn@^4.16.1
tailwindcss@^4.1.0
tsx@^4.21.0
typescript@^5.9.0
vite@^8.0.16

obfuscation 1

dynamic require()/import() BeatAPI-BeatDesign-ad7569e/src/lib/crypto.test.ts :22 const cryptoModule = await import(${JSON.stringify(moduleUrl)});

transport_posture 1

binds all interfaces (0.0.0.0) BeatAPI-BeatDesign-ad7569e/src/mcp/http-server.test.ts :89 host: '0.0.0.0',