github TypeScript analyzed 2bcbc86

Canonry/canonry

github

Agent-first AI SEO (AEO/GEO) operating platform.

maintainer
Canonry
licence
NOASSERTION
first seen
2026-07-02
last seen
2026-09-10
releases · 30d
2
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  2. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  3. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  4. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  5. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  6. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  7. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  8. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  9. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  10. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  11. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  12. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  13. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  14. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  15. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  16. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  17. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  18. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  19. HIGH code analysis flagged hidden prompt content in Canonry/canonry
  20. HIGH code analysis flagged hidden prompt content in Canonry/canonry
capabilities 2 tools
transport stdio · streamable-http · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • canonry_help
  • canonry_load_toolkit
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 2bcbc86 · analyzer v33 · 4h ago

skills & prompt files 41

  • hidden: agent-rules: skill-exfil Canonry-canonry-2bcbc86/packages/canonry/AGENTS.md :39 secret→sink: | `src/server.ts` | Fastify server setup — mounts api-routes, serves SPA, registers providers. Read-only embed mode (#716): resolves `resolveEmbedConfig(process.env, config)` at boot; whe

danger signals17

code evidence vwp-traffic-logger-v1.1.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1724

filesystem 242

  • fs (weak) Canonry-canonry-2bcbc86/apps/api/test/app.test.ts :3 import fs from 'node:fs'
  • fs Canonry-canonry-2bcbc86/apps/web/build.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/scripts/scan-raw-colors.mjs :7 import { readFileSync, readdirSync, statSync } from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/test/chart-primitives.test.ts :1 import { readFile } from 'node:fs/promises'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/test/dashboard-class-baseline.test.tsx :1 import { readFileSync, readdirSync } from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/test/design-tokens.test.ts :1 import { readFile } from 'node:fs/promises'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/test/onboarding-surface-instrumented.test.ts :1 import { readFileSync } from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/test/project-subnav.test.tsx :3 import { readFile } from 'node:fs/promises'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/test/query-invalidation.test.ts :1 import { existsSync, readdirSync, readFileSync } from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/test/write-controls-coverage.test.ts :16 import { readdirSync, readFileSync } from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/apps/web/vite.config.ts :3 import { readFileSync } from 'node:fs'
  • fs Canonry-canonry-2bcbc86/packages/api-client-generated/codegen.ts :12 import fs from 'node:fs/promises'
show 28 more
  • fs Canonry-canonry-2bcbc86/packages/api-routes/src/cdp.ts :1 import fs from 'node:fs'
  • fs Canonry-canonry-2bcbc86/packages/api-routes/src/doctor/checks/agent.ts :2 import fs from 'node:fs'
  • fs Canonry-canonry-2bcbc86/packages/api-routes/src/doctor/checks/runtime-state.ts :1 import fs from 'node:fs'
  • fs Canonry-canonry-2bcbc86/packages/api-routes/src/index.ts :4 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/ads-activation-routes.test.ts :1 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/ads-live-delivery.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/ads-routes.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/analytics-anchor-query-plan.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/analytics-execution-identity.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/analytics.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/api-key-project-scope.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/apply-absent-queries.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/audit-attribution.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/auth-malformed.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/backlinks.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/bing.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/cdp.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/citations.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/competitor-landscape.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/composites.test.ts :1 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/content.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/discovery-replay.test.ts :1 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/discovery.test.ts :1 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/doctor-ads.test.ts :2 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/doctor-agent.test.ts :3 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/doctor-backlinks.test.ts :1 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/doctor-content.test.ts :1 import fs from 'node:fs'
  • fs (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/doctor-gbp-auth.test.ts :2 import fs from 'node:fs'

202 more not shown — this panel samples each group; the count above is the real total.

shell / exec 19

  • shell Canonry-canonry-2bcbc86/apps/web/build.ts :1 import { execFileSync } from 'node:child_process'
  • shell Canonry-canonry-2bcbc86/packages/canonry/build-web.ts :4 import { execFileSync } from 'node:child_process'
  • shell Canonry-canonry-2bcbc86/packages/canonry/src/cloudflare-worker-deploy.ts :1 import { spawn } from 'node:child_process'
  • shell Canonry-canonry-2bcbc86/packages/canonry/src/commands/daemon.ts :1 import { spawn } from 'node:child_process'
  • shell Canonry-canonry-2bcbc86/packages/canonry/src/commands/google.ts :104 const { spawn } = await import('node:child_process')
  • shell (weak) Canonry-canonry-2bcbc86/packages/canonry/test/plugin-bundle.test.ts :2 import { execFileSync, spawnSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/packages/db/test/schedules-migration.test.ts :6 import { execSync } from 'node:child_process'
  • shell Canonry-canonry-2bcbc86/packages/integration-commoncrawl/src/plugin-installer.ts :1 import { spawn } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/packages/integration-commoncrawl/test/plugin-installer.test.ts :11 const actual = await vi.importActual<typeof import('node:child_process')>('node:child_process')
  • shell (weak) Canonry-canonry-2bcbc86/scripts/bump-aeo-audit.mjs :30 import { execFileSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/scripts/generated-git-check.ts :1 import { execFileSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/scripts/lint-changed.mjs :2 import { execFileSync, spawnSync } from 'node:child_process'
show 7 more
  • shell (weak) Canonry-canonry-2bcbc86/scripts/pre-push.mjs :1 import { execFileSync, spawnSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/scripts/publish-canonry-npm.mjs :3 import { spawnSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/scripts/sync-canonry-plugin.mjs :2 import { execFileSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/test/generated-git-check.test.ts :1 import { execFileSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/test/lint-changed.test.ts :1 import { execFile, execFileSync, spawnSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/test/pre-push.test.ts :1 import { execFileSync, spawnSync } from 'node:child_process'
  • shell (weak) Canonry-canonry-2bcbc86/test/web-build.test.ts :1 import { spawnSync } from 'node:child_process'

network 69

  • net Canonry-canonry-2bcbc86/apps/vals/ai-visibility-check/src/ui/client.ts :136 fetch(form.dataset.jsonAction || '/api/checks', {
  • net (weak) Canonry-canonry-2bcbc86/apps/vals/ai-visibility-check/test/backend/app.test.ts :210 const apiResponse = await app.fetch(new Request(`https://val.test/api/checks/${expired.id}`))
  • net (weak) Canonry-canonry-2bcbc86/apps/vals/ai-visibility-check/test/backend/mcp.test.ts :224 const response = await app.fetch(
  • net (weak) Canonry-canonry-2bcbc86/apps/vals/ai-visibility-check/test/backend/storage.test.ts :248 const rejected = await app.fetch(publicCheckRequest('capacity.example'))
  • net Canonry-canonry-2bcbc86/apps/vals/brand-perception-check/src/ui/client.ts :114 fetch(form.dataset.jsonAction || '/api/checks', {
  • net (weak) Canonry-canonry-2bcbc86/apps/vals/brand-perception-check/test/backend/app.test.ts :161 const apiResponse = await app.fetch(new Request(`https://val.test/api/checks/${expired.id}`))
  • net (weak) Canonry-canonry-2bcbc86/apps/vals/brand-perception-check/test/backend/mcp.test.ts :189 const response = await app.fetch(
  • net Canonry-canonry-2bcbc86/apps/web/src/api-aero.ts :90 const res = await fetch(`${API_BASE}/projects/${encodeURIComponent(project)}/agent/transcript`, {
  • net Canonry-canonry-2bcbc86/apps/web/src/api.ts :377 * rejects relative URLs — `fetch('/api/v1/…')` works at runtime in a
  • net (weak) Canonry-canonry-2bcbc86/apps/web/test/api-fetch-headers.test.ts :6 * After the hey-api migration the SDK calls `fetch(new Request(...))` —
  • net (weak) Canonry-canonry-2bcbc86/apps/web/test/ga-connect.test.ts :6 * The hey-api SDK passes a `Request` object to fetch (not `(url, init)`).
  • net (weak) Canonry-canonry-2bcbc86/apps/web/test/mock-fetch.ts :4 * The hey-api SDK calls `fetch(new Request(url, init))` instead of the
show 28 more
  • net Canonry-canonry-2bcbc86/apps/worker/src/health-server.ts :1 import { createServer } from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/apps/worker/test/worker.test.ts :2 import { createServer } from 'node:net'
  • net Canonry-canonry-2bcbc86/eslint.config.js :37 // packages/canonry/src by the two raw-`fetch()` guards. The AGENTS.md rules
  • net Canonry-canonry-2bcbc86/packages/api-client-generated/codegen.ts :33 // have to fall back to hand-typed `fetch()` calls.
  • net Canonry-canonry-2bcbc86/packages/api-routes/src/measurement-sitemap-fetch.ts :6 import http from 'node:http'
  • net Canonry-canonry-2bcbc86/packages/api-routes/src/traffic.ts :2 import { isIP } from 'node:net'
  • net Canonry-canonry-2bcbc86/packages/api-routes/src/webhooks.ts :3 import http from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/measurement-sitemap-fetch.test.ts :1 import http from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/packages/api-routes/test/measurement-sitemap-ssrf.test.ts :1 import net from 'node:net'
  • net Canonry-canonry-2bcbc86/packages/canonry/src/client.ts :816 const res = await fetch(`${origin}/health`, {
  • net Canonry-canonry-2bcbc86/packages/canonry/src/commands/daemon.ts :31 const res = await fetch(url)
  • net Canonry-canonry-2bcbc86/packages/canonry/src/gbp-sync.ts :362 // records this fetch (mirrors the lodging touch above).
  • net Canonry-canonry-2bcbc86/packages/canonry/src/site-audit-root.ts :1 import http, { type IncomingHttpHeaders } from 'node:http'
  • net Canonry-canonry-2bcbc86/packages/canonry/src/site-fetch.ts :1 import https from 'node:https'
  • net Canonry-canonry-2bcbc86/packages/canonry/src/sitemap-parser.ts :71 res = await fetch(url)
  • net Canonry-canonry-2bcbc86/packages/canonry/src/telemetry.ts :396 void fetch(TELEMETRY_ENDPOINT, {
  • net Canonry-canonry-2bcbc86/packages/canonry/src/update-check.ts :84 const res = await fetch(NPM_DIST_TAGS_URL, {
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/bing-inspect-sitemap.test.ts :3 import http from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/client-measurement-v2.test.ts :2 import { createServer, type IncomingHttpHeaders, type Server } from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/cloudflare-worker-deploy.test.ts :50 workerScript: `export default { fetch() { return env.${CLOUDFLARE_WORKER_BINDINGS.bearerToken} } }`,
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/gbp-sync.test.ts :445 // Immediate second sync: just verified (< 7d) → must NOT re-fetch (the bug
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/mcp-http-transport.test.ts :40 const res = await fetch(`${built.origin}${opts.url}`, {
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/mcp-registry.test.ts :1 import { createServer, type ServerResponse } from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/mcp-research-access.test.ts :80 const response = await fetch(`${origin}/api/v1/mcp`, {
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/mcp-stdio.test.ts :1 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/research-limit-cli-error.test.ts :1 import { createServer, type ServerResponse } from 'node:http'
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/server-listen-lifecycle.test.ts :3 import net from 'node:net'
  • net (weak) Canonry-canonry-2bcbc86/packages/canonry/test/server-shutdown.test.ts :2 import http from 'node:http'

29 more not shown — this panel samples each group; the count above is the real total.

secrets 9

  • secrets Canonry-canonry-2bcbc86/packages/canonry/src/places-config.ts :28 const envKey = process.env.GOOGLE_PLACES_API_KEY?.trim()
  • secrets Canonry-canonry-2bcbc86/packages/canonry/src/server.ts :2008 process.env.GOOGLE_STATE_SECRET ?? crypto.randomBytes(32).toString("hex");
  • secrets (weak) Canonry-canonry-2bcbc86/packages/canonry/test/agent-providers.test.ts :453 const priorToken = process.env.DEEPINFRA_TOKEN
  • secrets (weak) Canonry-canonry-2bcbc86/packages/canonry/test/cli-operator-contract.test.ts :951 const originalGeminiApiKey = process.env.GEMINI_API_KEY
  • secrets (weak) Canonry-canonry-2bcbc86/packages/canonry/test/places-config.test.ts :30 process.env.GOOGLE_PLACES_API_KEY = 'env-key'
  • secrets (weak) Canonry-canonry-2bcbc86/packages/canonry/test/server-embed.test.ts :196 process.env.CANONRY_DASHBOARD_REQUIRE_PASSWORD = '0'
  • secrets (weak) Canonry-canonry-2bcbc86/scripts/capture-discovery-replay-fixtures.ts :30 const KEY = process.env.CANONRY_KEY
  • secrets (weak) Canonry-canonry-2bcbc86/scripts/check-better-sqlite3-prebuilds.mjs :40 if (process.env.GITHUB_TOKEN && url.includes('api.github.com')) {
  • secrets (weak) Canonry-canonry-2bcbc86/scripts/verify-val-town-target.mjs :145 apiKey: process.env.VAL_TOWN_API_KEY,

database 6

  • db Canonry-canonry-2bcbc86/packages/db/src/client.ts :3 import Database from 'better-sqlite3'
  • db (weak) Canonry-canonry-2bcbc86/packages/db/test/ga-daily-engagement-migration.test.ts :5 import Database from 'better-sqlite3'
  • db (weak) Canonry-canonry-2bcbc86/packages/db/test/index-parity.test.ts :5 import Database from 'better-sqlite3'
  • db (weak) Canonry-canonry-2bcbc86/packages/db/test/index.test.ts :6 import Database from 'better-sqlite3'
  • db (weak) Canonry-canonry-2bcbc86/packages/db/test/migration-parity.test.ts :5 import Database from 'better-sqlite3'
  • db (weak) Canonry-canonry-2bcbc86/packages/db/test/migration-version-invariants.test.ts :5 import Database from 'better-sqlite3'

tool registrations 2

  • canonry_help Canonry-canonry-2bcbc86/packages/canonry/src/mcp/server.ts :127
  • canonry_load_toolkit Canonry-canonry-2bcbc86/packages/canonry/src/mcp/server.ts :147

install hooks 4

  • preinstall Canonry-canonry-2bcbc86/package.json :8 test ! -f scripts/check-node.mjs || node scripts/check-node.mjs
  • prepare Canonry-canonry-2bcbc86/package.json :30 husky || true
  • prepublishOnly Canonry-canonry-2bcbc86/packages/canonry/package.json :46 cp ../../README.md ./README.md && pnpm run build
  • prepublishOnly Canonry-canonry-2bcbc86/packages/val-kit/package.json :57 pnpm run build

declared dependencies 15

  • @eslint/js@^9.0.0
  • @types/better-sqlite3@^7.6.13
  • @types/node@^24.5.1
  • better-sqlite3@^12.11.1
  • eslint@^9.0.0
  • eslint-plugin-react-hooks@^7.1.1
  • eslint-plugin-regexp@^3.1.0
  • globals@^17.4.0
  • husky@^9.1.7
  • jsdom@^29.0.0
  • tsx@^4.20.5
  • typescript@^5.9.2
show 3 more
  • typescript-eslint@^8.43.0
  • vitest@^4.1.0
  • yaml@^2.8.2

transport_posture 4

  • network-listening, binds all interfaces, no auth detected Canonry-canonry-2bcbc86/apps/api/src/index.ts :9 host: '0.0.0.0',
  • network-listening, binds all interfaces, no auth detected Canonry-canonry-2bcbc86/apps/worker/src/health-server.ts :42 server.listen(env.workerPort, '0.0.0.0', () => {
  • network-listening, binds all interfaces, no auth detected Canonry-canonry-2bcbc86/packages/canonry/test/daemon.test.ts :10 expect(buildServeForwardArgs({ port: '4200', host: '0.0.0.0', basePath: '/c' })).toEqual([
  • binds all interfaces (0.0.0.0) Canonry-canonry-2bcbc86/packages/canonry/test/index.test.ts :657 const app = await createServer({ config, db, logger: false, host: '0.0.0.0' })