MCP Observatory
6m ago Tracked 59,479 Last 6m ago 24h 2,575
github Python analyzed 0a4f90a

Caprista/KarvyLoop

github

The agent that learns how you decide - and proves it by never deciding for you. A local-first, loop-native runtime for a team of AI agents on your machine.

maintainer
Caprista
licence
MIT
first seen
2026-07-01
last seen
2026-09-17
releases · 30d
8
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 6 tools
transport stdio · streamable-http · http counts 6 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • click
  • get_screen_size
  • move
  • press_key
  • screenshot
  • type_text
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 0a4f90a · analyzer v33 · 6h ago

skills & prompt files 8

danger signals8

code evidence v2026.9.17 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 972

filesystem 350

  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/adapter/applier.py :14 import pathlib
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/adapter/planner.py :242 import pathlib
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/adapter/source.py :14 import pathlib
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/adapter/validator.py :13 import pathlib
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/atoms/registry.py :22 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/capability/fs_grants.py :21 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/channels/email_channel.py :29 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/channels/inbox_pipe.py :37 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/channels/webhook_channel.py :48 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/_runtime.py :15 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/chat.py :15 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/computer_use_e2e.py :45 from pathlib import Path
show 28 more
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/computer_use_setup.py :22 import shutil
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/export_cmd.py :22 from pathlib import Path, PurePosixPath
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/import_cmd.py :31 import shutil
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/init.py :11 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/intent_pump.py :26 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/main.py :355 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/manage.py :19 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/minimax_login_cmd.py :13 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/replay.py :29 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/run.py :16 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/run_loop.py :26 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cli/wizard.py :25 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/coding/coding_config.py :12 import pathlib
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/coding/paradigm_prompt.py :16 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/coding/prompt.py :95 content = open(p, "r", encoding="utf-8", errors="replace").read()
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/coding/session.py :22 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/coding/tools/mcp_tool.py :281 import pathlib
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/coding/tools/web.py :60 import pathlib
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/coding/web_verify.py :22 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/belief_store.py :14 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/concepts.py :27 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/conversation.py :29 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/distill_session.py :16 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/pursuit.py :22 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/pursuit_store.py :22 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/recall.py :20 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/sqlite_trace.py :26 from pathlib import Path
  • fs Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/weekly_digest.py :27 from pathlib import Path

310 more not shown — this panel samples each group; the count above is the real total.

shell / exec 30

  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/cli/computer_use_setup.py :23 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/coding/prompt.py :17 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/console/capability_install.py :21 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/console/routes_ops.py :117 import subprocess as _sp
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/console/upgrade_runner.py :19 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/external_runtime/bridge.py :26 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/karvy/slash.py :16 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/platform/linux/egress_proxy.py :37 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/platform/win/degraded.py :24 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/platform/win/restricted.py :59 import subprocess
  • shell Caprista-KarvyLoop-0a4f90a/karvyloop/update.py :14 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/external_runtime/test_bridge.py :114 import subprocess
show 18 more
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/integration/test_console_linux_smoke.py :22 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_cli_console.py :13 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_console_lazy_ui_playwright.py :30 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_console_takeover.py :13 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_conversation.py :17 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_desk_soul_playwright.py :26 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_distribution.py :22 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_fastbrain_trace_habit.py :17 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_fastbrain_trace_index.py :20 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_landlock.py :152 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_mcp_hotload.py :19 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_mcp_remote.py :26 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_relay_e2e_interop.py :12 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_sqlite_persistence.py :18 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_win_sandbox.py :209 "import subprocess,sys\n"
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_workbench_e2e.py :10 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_workbench_serve.py :15 import subprocess
  • shell (weak) Caprista-KarvyLoop-0a4f90a/tests/test_workbench_widgets.py :11 import subprocess

network 71

  • net Caprista-KarvyLoop-0a4f90a/karvyloop/atoms/terminal.py :69 """从 httpx.HTTPStatusError 一类异常上取状态码(拿不到 = None)。"""
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/channels/email_channel.py :31 from urllib.parse import quote
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/channels/webhook_channel.py :51 from urllib.parse import quote, urlsplit
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/cli/main.py :529 import socket as _socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/coding/tools/mcp_tool.py :246 import urllib.parse as _up
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/coding/tools/urlguard.py :26 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/coding/tools/web.py :23 from urllib.parse import urljoin
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/coding/web_verify.py :17 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/console/access.py :16 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/console/entry.py :33 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/console/mcp_presets.py :430 import urllib.parse as _up
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/console/oauth_broker.py :20 from urllib.parse import parse_qs, urlsplit
show 28 more
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/console/routes_memory.py :91 from urllib.parse import unquote
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/console/routes_models.py :286 import httpx
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/console/upgrade_runner.py :18 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/doctor.py :14 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/doctor_liveness.py :21 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/external_runtime/connector.py :24 import urllib.error
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/gateway/providers/anthropic.py :90 import httpx # 延迟导入
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/gateway/providers/openai_completions.py :161 import httpx # 延迟导入(测试走 mock 不需要)
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/karvy/slash.py :122 "import socket,time,subprocess,json\n"
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/llm/minimax_oauth.py :96 import httpx
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/mcp_client.py :164 import httpx
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/mcp_oauth.py :5 `httpx.Auth`,直接塞进我们现有的 remote 连接的 httpx client 即可)。我们只写**属于自己
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/mcp_registry.py :83 import httpx
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/notifications/dingtalk.py :91 import httpx
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/platform/linux/egress_proxy.py :35 import socket
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/registry/skill_catalog.py :39 import httpx
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/registry/skill_import.py :61 import httpx # 延迟导入:不触网就不需要
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/relay/client.py :91 from urllib.parse import quote
  • net Caprista-KarvyLoop-0a4f90a/karvyloop/update.py :17 import urllib.request
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/external_runtime/test_claim_handshake.py :399 import urllib.request
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/integration/test_anthropic_request_shape.py :105 return_value=httpx.Response(200, text=_min_sse_response(),
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/security/test_ssrf.py :128 import httpx
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/test_anthropic_adapter_auth.py :52 return_value=httpx.Response(200, text="")
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/test_away_bundle.py :75 import urllib.request
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/test_console_access.py :79 import socket
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/test_console_browser.py :13 import socket
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/test_console_browser_first10.py :16 import socket
  • net (weak) Caprista-KarvyLoop-0a4f90a/tests/test_console_browser_pending.py :13 import socket

31 more not shown — this panel samples each group; the count above is the real total.

secrets 3

  • secrets Caprista-KarvyLoop-0a4f90a/karvyloop/coding/tools/web.py :72 env_key = (os.environ.get("KARVYLOOP_SEARCH_API_KEY") or "").strip()
  • secrets Caprista-KarvyLoop-0a4f90a/karvyloop/external_runtime/connector.py :109 secret = args.secret or os.environ.get("KARVYLOOP_CLAIM_SECRET", "")
  • secrets (weak) Caprista-KarvyLoop-0a4f90a/tests/test_gateway.py :124 os.environ["TEST_KEY"] = "sk-secret-DO-NOT-LEAK"

database 16

  • db Caprista-KarvyLoop-0a4f90a/karvyloop/a2a/transport/__init__.py :77 """Lazy import:避免 transport 顶层强制 import redis。"""
  • db Caprista-KarvyLoop-0a4f90a/karvyloop/a2a/transport/bus_redis.py :50 import redis # type: ignore
  • db Caprista-KarvyLoop-0a4f90a/karvyloop/cognition/sqlite_trace.py :23 import sqlite3
  • db (weak) Caprista-KarvyLoop-0a4f90a/karvyloop/console/routes_demo.py :17 import sqlite3
  • db Caprista-KarvyLoop-0a4f90a/karvyloop/crystallize/sqlite_store.py :27 import sqlite3
  • db Caprista-KarvyLoop-0a4f90a/karvyloop/karvy/fastbrain/trace_habit.py :30 import sqlite3
  • db Caprista-KarvyLoop-0a4f90a/karvyloop/karvy/fastbrain/trace_index.py :29 import sqlite3
  • db Caprista-KarvyLoop-0a4f90a/karvyloop/llm/token_ledger.py :23 import sqlite3
  • db Caprista-KarvyLoop-0a4f90a/karvyloop/notifications/outbox.py :3 import sqlite3
  • db (weak) Caprista-KarvyLoop-0a4f90a/tests/test_a2a_tier2.py :299 import redis # type: ignore
  • db (weak) Caprista-KarvyLoop-0a4f90a/tests/test_crystallize_cluster.py :97 import sqlite3
  • db (weak) Caprista-KarvyLoop-0a4f90a/tests/test_demo_instance.py :17 import sqlite3
show 4 more
  • db (weak) Caprista-KarvyLoop-0a4f90a/tests/test_gateway_token_recording.py :116 import sqlite3
  • db (weak) Caprista-KarvyLoop-0a4f90a/tests/test_run_id_thread.py :18 import sqlite3
  • db (weak) Caprista-KarvyLoop-0a4f90a/tests/test_sqlite_persistence.py :412 import sqlite3
  • db (weak) Caprista-KarvyLoop-0a4f90a/tests/test_token_ledger_rollup.py :216 import sqlite3

tool registrations 6

  • screenshot Caprista-KarvyLoop-0a4f90a/karvyloop/computer/native_server.py :147
  • get_screen_size Caprista-KarvyLoop-0a4f90a/karvyloop/computer/native_server.py :151
  • move Caprista-KarvyLoop-0a4f90a/karvyloop/computer/native_server.py :156
  • click Caprista-KarvyLoop-0a4f90a/karvyloop/computer/native_server.py :160
  • type_text Caprista-KarvyLoop-0a4f90a/karvyloop/computer/native_server.py :164
  • press_key Caprista-KarvyLoop-0a4f90a/karvyloop/computer/native_server.py :168

declared dependencies 26

  • mcp@>=1.9,<2
  • pydantic@>=2.0,<3
  • pyyaml@>=6.0,<7
  • httpx@>=0.27,<1
  • textual@>=0.50,<9
  • textual-serve@>=0.5,<2
  • fastapi@>=0.115,<1
  • uvicorn@>=0.30,<1
  • croniter@>=2.0,<7
  • playwright@>=1.40,<2
  • pyautogui@>=0.9.54,<1
  • pillow@>=10,<12
show 14 more
  • redis@>=5.0,<9
  • pypdf@>=4.0,<7
  • python-docx@>=1.1,<2
  • openpyxl@>=3.1,<4
  • faster-whisper@>=1.1,<2
  • rapidocr-onnxruntime@>=1.2,<2
  • dingtalk-stream@>=0.20,<1
  • cryptography@>=42,<48
  • pytest@>=8.0
  • pytest-asyncio@>=0.23
  • respx@>=0.21
  • psutil@>=5.9
  • hypothesis@>=6.100
  • ruff@>=0.6

transport_posture 2

  • network-listening, binds all interfaces, no auth detected Caprista-KarvyLoop-0a4f90a/tests/test_cli_console.py :88 host="0.0.0.0",
  • binds all interfaces (0.0.0.0) Caprista-KarvyLoop-0a4f90a/tests/test_workbench_serve.py :60 host="0.0.0.0",