github TypeScript re-analysis due

Cambrionic/winnow

Winnow — an embedded TypeScript SDK that lets an agent use many MCP servers without context bloat.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit c787cb8 · analyzer v32 · 1h ago

over-broad OAuth scope site_admin Cambrionic-winnow-c787cb8/bench/fixtures.js :126 type: "User", site_admin: false,
over-broad OAuth scope site_admin Cambrionic-winnow-c787cb8/examples/servers.ts :8 const user = (login: string) => ({ login, id: 1000 + n, url: `https://api.github.com/users/${login}`, html_url: `https://github.com/${login}`, type: "User", site_admin: false });

code evidence vv0.2.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 57

fs Cambrionic-winnow-c787cb8/bench/perf-compare.mjs :18 import fs from "node:fs";
fs Cambrionic-winnow-c787cb8/bench/warmstart.ts :6 import fs from "node:fs";
fs Cambrionic-winnow-c787cb8/src/cache.ts :4 import fs from "node:fs";
fs Cambrionic-winnow-c787cb8/src/embedding-cache.ts :13 import fs from "node:fs";
fs Cambrionic-winnow-c787cb8/src/gateway/cli.ts :6 import fs from "node:fs";
fs (weak) Cambrionic-winnow-c787cb8/test/cache.test.ts :3 import fs from "node:fs";
fs (weak) Cambrionic-winnow-c787cb8/test/embedding-cache.test.ts :3 import fs from "node:fs";
fs (weak) Cambrionic-winnow-c787cb8/test/gateway-stdio-lifecycle.test.ts :12 import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
fs (weak) Cambrionic-winnow-c787cb8/test/incremental-refresh.test.ts :6 import fs from "node:fs";
fs (weak) Cambrionic-winnow-c787cb8/test/parallel-listing.test.ts :6 import fs from "node:fs";

shell Cambrionic-winnow-c787cb8/bench/public-mcp.mjs :19 import { execFileSync } from "node:child_process";
shell Cambrionic-winnow-c787cb8/bench/real-servers.mjs :87 say(`\nFlat at ~${cap} MB (default \`maxWorkers: 4\` × 32 MB SAB) regardless of concurrency — vs unbounded per-exec spawn (~32 MB each). Baseline arrayBuffers ${mb(base)} MB.\n`);
shell Cambrionic-winnow-c787cb8/src/client.ts :174 * intermediates never reach context; only exec()'s final return is capped. */
shell Cambrionic-winnow-c787cb8/src/sandbox-pool.ts :171 private spawn(): void {
shell (weak) Cambrionic-winnow-c787cb8/test/auth-passthrough.test.ts :32 test("auth: exec() threads the identity to every in-sandbox call", async () => {
shell (weak) Cambrionic-winnow-c787cb8/test/gateway-stdio-lifecycle.test.ts :11 import { spawn, execFile } from "node:child_process";

net (weak) Cambrionic-winnow-c787cb8/examples/real-http.ts :5 import http from "node:http";
net Cambrionic-winnow-c787cb8/src/auth.ts :50 const res = await fetch(cfg.tokenUrl, {
net Cambrionic-winnow-c787cb8/src/gateway/index.ts :3 import http from "node:http";
net (weak) Cambrionic-winnow-c787cb8/test/gateway-pool.test.ts :7 import type { AddressInfo } from "node:net";
net (weak) Cambrionic-winnow-c787cb8/test/http-auth.test.ts :3 import http from "node:http";

secrets Cambrionic-winnow-c787cb8/src/gateway/cli.ts :38 const token = process.env.WINNOW_GATEWAY_TOKEN;