See what your AI agents can cause, route them safely, and prove what happened. Open-source execution authority for AI agents — consequence preview, trust routing, signed receipts.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 1bc2162 · analyzer v33 · 8h ago
danger signals2
- credential in logs credential in log BlockSiFr-ttp-protocol-1bc2162/reference-implementations/trust-authority/src/index.ts :125
console.log(`[TTP Authority] Admin API key: ${ADMIN_API_KEY}`) - credential in logs credential in log BlockSiFr-ttp-protocol-1bc2162/reference-implementations/trust-authority/src/scripts/generate-keys.ts :29
console.log(`Private Key: ${privateKey}`)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 125
filesystem 22
- fs (weak) BlockSiFr-ttp-protocol-1bc2162/.github/scripts/ttp-local-authorize.mjs :2
import fs from 'node:fs' - fs BlockSiFr-ttp-protocol-1bc2162/assets/brand/render-png.mjs :4
import { readFileSync, writeFileSync, readdirSync } from "node:fs"; - fs BlockSiFr-ttp-protocol-1bc2162/packages/pctr/bin/pctr.mjs :12
import fs from 'node:fs'; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/packages/pctr/scripts/render-terminal-svg.mjs :6
import fs from 'node:fs'; - fs BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/boundary.mjs :2
import fs from 'node:fs'; - fs BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/discover.mjs :1
import fs from 'node:fs'; - fs BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/keys.mjs :2
import fs from 'node:fs'; - fs BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/store.mjs :1
import fs from 'node:fs'; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/packages/pctr/tests/aggregation.test.mjs :3
import fs from 'node:fs'; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/packages/pctr/tests/attest.test.mjs :3
import fs from 'node:fs'; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/packages/pctr/tests/boundary.test.mjs :3
import fs from 'node:fs'; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/packages/pctr/tests/discover.test.mjs :3
import fs from 'node:fs';
show 10 more
- fs (weak) BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/server.test.mjs :5
import fs from 'node:fs'; - fs BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/signing.mjs :2
import fs from 'node:fs'; - fs BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/storage.mjs :1
import fs from 'node:fs'; - fs BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/verify-receipt.mjs :1
import fs from 'node:fs'; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/reference-implementations/trust-authority/src/scripts/generate-keys.ts :8
import * as fs from "fs" - fs BlockSiFr-ttp-protocol-1bc2162/services/authority/policyLoader.ts :1
import fs from "node:fs" - fs BlockSiFr-ttp-protocol-1bc2162/src/lib.js :1
import { readFile } from "node:fs/promises"; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/tests/conformance.test.mjs :1
import test from 'node:test';import assert from 'node:assert/strict';import fs from 'node:fs'; - fs (weak) BlockSiFr-ttp-protocol-1bc2162/tests/ttp-cli.test.mjs :2
import { mkdtemp, writeFile } from "node:fs/promises"; - fs BlockSiFr-ttp-protocol-1bc2162/tools/validate-contracts.mjs :1
import fs from 'node:fs';
shell / exec 5
- shell (weak) BlockSiFr-ttp-protocol-1bc2162/packages/pctr/scripts/render-terminal-svg.mjs :5
import { execFileSync } from 'node:child_process'; - shell BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/attest.mjs :2
import { execFile } from 'node:child_process'; - shell BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/probe.mjs :1
import { execFile } from 'node:child_process'; - shell (weak) BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/server.test.mjs :3
import { spawn } from 'node:child_process'; - shell (weak) BlockSiFr-ttp-protocol-1bc2162/scripts/check-agt-parity.mjs :7
import { execFileSync } from 'node:child_process';
network 10
- net BlockSiFr-ttp-protocol-1bc2162/apps/trust-route-resolver/src/server.mjs :1
import http from 'node:http' - net (weak) BlockSiFr-ttp-protocol-1bc2162/examples/basic-agent/index.ts :57
const response = await fetch(`${SERVICE_URL}/api/issue-discount`, { - net BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/boundary.mjs :1
import http from 'node:http'; - net BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/server.mjs :1
import http from 'node:http'; - net (weak) BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/server.test.mjs :6
import net from 'node:net'; - net BlockSiFr-ttp-protocol-1bc2162/reference-implementations/trust-authority/src/routes.ts :889
const response = await fetch(confirmationUrl, { - net BlockSiFr-ttp-protocol-1bc2162/sdk/node/index.js :6
const response = await fetch(`${baseUrl.replace(/\/$/, '')}/re/authorize`, { - net BlockSiFr-ttp-protocol-1bc2162/sdk/typescript/src/client.ts :88
response = await this.options.fetch(url, { - net BlockSiFr-ttp-protocol-1bc2162/sdk/typescript/src/issuer.ts :117
response = await this.options.fetch(url, { - net BlockSiFr-ttp-protocol-1bc2162/services/authority/index.ts :1
import http from "node:http"
secrets 8
- secrets (weak) BlockSiFr-ttp-protocol-1bc2162/.github/scripts/ttp-local-authorize.mjs :104
const signature = crypto.createHmac('sha256', process.env.TTP_LOCAL_SIGNING_KEY || 'ttp-local-dev-signing-key').update(chainHash).digest('hex') - secrets (weak) BlockSiFr-ttp-protocol-1bc2162/examples/basic-agent/index.ts :18
const AGENT_API_KEY = process.env.TTP_API_KEY ?? "dev-agent-key" - secrets BlockSiFr-ttp-protocol-1bc2162/packages/pctr/src/keys.mjs :53
if (process.env.PCTR_PRIVATE_KEY) { - secrets BlockSiFr-ttp-protocol-1bc2162/reference-implementations/issuers/src/api-gateway-issuer.ts :125
privateKey: process.env.ISSUER_PRIVATE_KEY ?? "", - secrets BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/signing.mjs :5
const HMAC_SECRET = process.env.RECEIPT_HMAC_SECRET ?? 'local-dev-secret'; - secrets BlockSiFr-ttp-protocol-1bc2162/reference-implementations/trust-authority/src/index.ts :34
const ADMIN_API_KEY = process.env.ADMIN_API_KEY ?? "dev-admin-key" - secrets BlockSiFr-ttp-protocol-1bc2162/sdk/typescript/src/index.ts :10
* apiKey: process.env.TTP_API_KEY, - secrets BlockSiFr-ttp-protocol-1bc2162/sdk/typescript/src/issuer.ts :181
* privateKey: process.env.PEER_ISSUER_PRIVATE_KEY,
install hooks 1
- prepublishOnly BlockSiFr-ttp-protocol-1bc2162/sdk/typescript/package.json :10
npm run build
declared dependencies 4
- @fontsource/inter@^5.2.8
- @fontsource/jetbrains-mono@^5.2.8
- @fontsource/space-grotesk@^5.2.10
- @resvg/resvg-js@^2.6.2
perm:untrusted 1
- untrusted (weak) BlockSiFr-ttp-protocol-1bc2162/reference-implementations/runtime-authority-gate/server.test.mjs :69
const health = await fetch(`${BASE_URL}/healthz`).then((r) => r.json());