github analyzed e971074

CDCStream/captapi

Social media data from YouTube, TikTok, Instagram & Facebook. 62 tools, one API key.

maintainer: CDCStream
license: —
first seen: 2026-06-04
last seen: 2026-06-04
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-06-08 code analysis flagged hidden prompt content ×2 in CDCStream/captapi

capabilities 0 tools

transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e971074 · analyzer v19 · 2d ago

skills & prompt files 1

skillCDCStream-captapi-e971074/packages/captapi-skill/SKILL.md

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 7

fs CDCStream-captapi-e971074/frontend/app/opengraph-image.tsx :2 import { readFile } from "node:fs/promises";
fs CDCStream-captapi-e971074/packages/captapi-apify/generate.mjs :7 import { mkdirSync, writeFileSync } from "node:fs";
fs CDCStream-captapi-e971074/packages/captapi-apify/src/main.js :1 import { readFileSync } from "node:fs";
fs CDCStream-captapi-e971074/packages/captapi-cli/src/commands/agent.ts :8 } from "node:fs";
fs CDCStream-captapi-e971074/packages/captapi-cli/src/config.ts :12 } from "node:fs";
fs CDCStream-captapi-e971074/packages/captapi-make/generate.mjs :10 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
fs CDCStream-captapi-e971074/packages/captapi-skill/generate.mjs :7 import { writeFileSync } from "node:fs";

shell / exec 1

shell CDCStream-captapi-e971074/packages/captapi-cli/scripts/live-test.mjs :9 import { spawn } from "node:child_process";

network 15

net CDCStream-captapi-e971074/frontend/app/(marketing)/tools/youtube-thumbnail-maker/YouTubeThumbnailClient.tsx :134 const res = await fetch("/api/thumbnail-generate", {
net CDCStream-captapi-e971074/frontend/app/admin/blog/new/page.tsx :70 const res = await fetch("/api/blog/save", {
net CDCStream-captapi-e971074/frontend/app/api/ai-generate/route.ts :168 const res = await fetch("https://api.anthropic.com/v1/messages", {
net CDCStream-captapi-e971074/frontend/app/api/thumbnail-generate/route.ts :118 const res = await fetch(
net CDCStream-captapi-e971074/frontend/app/api/tool-run/route.ts :47 const res = await fetch(`${API_BASE}${endpoint}?${qs.toString()}`, {
net CDCStream-captapi-e971074/frontend/app/llms.txt/route.ts :180 const res = await fetch(url, {
net CDCStream-captapi-e971074/frontend/components/tools/ai-tool-client.tsx :82 const res = await fetch("/api/ai-generate", {
net CDCStream-captapi-e971074/frontend/components/tools/tool-runner-client.tsx :48 const res = await fetch("/api/tool-run", {
net CDCStream-captapi-e971074/frontend/lib/analytics.ts :50 geoPromise = fetch("/api/geo")
net CDCStream-captapi-e971074/frontend/lib/api-catalog.ts :738 code: `const res = await fetch(
net CDCStream-captapi-e971074/frontend/lib/api-client.ts :23 const res = await fetch(`${API_URL}${path}`, { ...init, headers });
net CDCStream-captapi-e971074/frontend/lib/blog.ts :126 await fetch("https://api.indexnow.org/indexnow", {
net CDCStream-captapi-e971074/packages/captapi-apify/src/main.js :57 res = await fetch(requestUrl, {
net CDCStream-captapi-e971074/packages/captapi-cli/src/client.ts :72 const res = await fetch(url, { method: "GET", headers: authHeaders(apiKey) });
net CDCStream-captapi-e971074/packages/captapi-mcp/src/index.ts :77 res = await fetch(requestUrl, {

secrets 13

secrets CDCStream-captapi-e971074/frontend/app/api/ai-generate/route.ts :159 const apiKey = process.env.ANTHROPIC_API_KEY;
secrets CDCStream-captapi-e971074/frontend/app/api/blog/save/route.ts :10 const secret = process.env.BLOG_ADMIN_SECRET;
secrets CDCStream-captapi-e971074/frontend/app/api/outrank/webhook/route.ts :19 const secret = process.env.OUTRANK_WEBHOOK_SECRET;
secrets CDCStream-captapi-e971074/frontend/app/api/thumbnail-generate/route.ts :103 const apiKey = process.env.GEMINI_API_KEY;
secrets CDCStream-captapi-e971074/frontend/app/api/tool-run/route.ts :35 const apiKey = process.env.CAPTAPI_TOOL_API_KEY;
secrets CDCStream-captapi-e971074/frontend/app/layout.tsx :24 const AHREFS_KEY = process.env.NEXT_PUBLIC_AHREFS_KEY || "";
secrets CDCStream-captapi-e971074/frontend/lib/supabase/admin.ts :16 const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
secrets CDCStream-captapi-e971074/frontend/lib/supabase/client.ts :8 process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
secrets CDCStream-captapi-e971074/frontend/lib/supabase/server.ts :10 process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
secrets CDCStream-captapi-e971074/frontend/middleware.ts :11 process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
secrets CDCStream-captapi-e971074/packages/captapi-cli/src/commands/auth.ts :59 const src = process.env.CAPTAPI_API_KEY ? " (from CAPTAPI_API_KEY)" : "";
secrets CDCStream-captapi-e971074/packages/captapi-cli/src/config.ts :40 const apiKey = process.env.CAPTAPI_API_KEY?.trim() || file.apiKey;
secrets CDCStream-captapi-e971074/packages/captapi-mcp/src/index.ts :18 const API_KEY = process.env.CAPTAPI_API_KEY?.trim();

declared dependencies 33

@radix-ui/react-avatar@^1.1.1
@radix-ui/react-dialog@^1.1.2
@radix-ui/react-dropdown-menu@^2.1.2
@radix-ui/react-label@^2.1.0
@radix-ui/react-select@^2.1.2
@radix-ui/react-slot@^1.1.0
@radix-ui/react-tabs@^1.1.1
@radix-ui/react-toast@^1.2.2
@supabase/ssr@^0.5.2
@supabase/supabase-js@^2.46.0
@tanstack/react-query@^5.59.0
@types/react-syntax-highlighter@^15.5.13
class-variance-authority@^0.7.1
clsx@^2.1.1
lucide-react@^0.460.0
next@^15.1.0
react@^19.0.0
react-dom@^19.0.0
react-syntax-highlighter@^15.6.6
react-typed@^2.0.12
recharts@^3.8.1
sonner@^2.0.7
tailwind-merge@^2.5.4
tailwindcss-animate@^1.0.7
@types/node@^22.9.0
@types/react@^19.0.0
@types/react-dom@^19.0.0
autoprefixer@^10.4.20
eslint@^9.14.0
eslint-config-next@^15.1.0
postcss@^8.4.49
tailwindcss@^3.4.14
typescript@^5.6.3

clipboard 4

navigator.clipboard CDCStream-captapi-e971074/frontend/app/(dashboard)/dashboard/agent-integrations/page.tsx :32 await navigator.clipboard.writeText(code);
navigator.clipboard CDCStream-captapi-e971074/frontend/app/(dashboard)/dashboard/api-keys/page.tsx :92 await navigator.clipboard.writeText(newKey.key);
navigator.clipboard CDCStream-captapi-e971074/frontend/components/tools/ai-tool-client.tsx :25 await navigator.clipboard.writeText(text);
navigator.clipboard CDCStream-captapi-e971074/frontend/components/tools/tool-runner-client.tsx :77 await navigator.clipboard.writeText(fullText);

obfuscation 1

dynamic require()/import() CDCStream-captapi-e971074/frontend/lib/api-catalog.ts :761 import (