github TypeScript analyzed f87ad2d

CarlxsMG/mcpbridge

Self-hosted MCP gateway that turns any REST, GraphQL, or MCP server into secure, governed AI tools — OpenAPI auto-discovery, per-tool guardrails, RBAC, circuit breaking, and a real admin UI.

maintainer: CarlxsMG
licence: MIT
first seen: 2026-07-23
last seen: 2026-09-15
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f87ad2d · analyzer v33 · 2d ago

skills & prompt files 1

agent-rules CarlxsMG-mcpbridge-f87ad2d/CLAUDE.md

danger signals41

suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/config-versions.test.ts :30 await registry.register("svc", [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/ha.test.ts :33 VALUES (?, '9.9.9.9', 'http://9.9.9.9/health', 'http://9.9.9.9', '9.9.9.9', 0, 1, 'rest', ?, ?)`,
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/ha.test.ts :90 await registry.register(name, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/ws-proxy.test.ts :69 await registry.register("dup-name", [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/approvals-mutation.test.ts :74 await registry.register(CLIENT, [doTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.5 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/approvals-mutation.test.ts :204 await registry.register(CLIENT2, [doTool], "http://1.2.3.5/health", "1.2.3.5", "http://1.2.3.5", "1.2.3.5");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/approvals.test.ts :35 await registry.register(CLIENT, [doTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/monitor-mutation.test.ts :58 await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/monitor.test.ts :29 await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/schedules-mutation.test.ts :50 await registry.register(name, [makeTool(toolName)], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/schedules.test.ts :36 await registry.register("svc", [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/teams-mutation.test.ts :51 await registry.register(name, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/teams.test.ts :39 await registry.register(name, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/admin/tool-policies/mutations/__tests__/mutations-batch.test.ts :1109 ws: { wsUrl: "http://5.6.7.8" },
suspicious endpoint docs.sentry.io (telemetry) CarlxsMG-mcpbridge-f87ad2d/src/catalog/builtin.ts :129 healthUrl: "https://docs.sentry.io/",
suspicious endpoint us.sentry.io (telemetry) CarlxsMG-mcpbridge-f87ad2d/src/catalog/builtin.ts :130 baseUrl: "https://us.sentry.io",
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/lib/__tests__/tool-config-mutation.test.ts :38 "http://1.2.3.4/health",
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/canary.test.ts :26 await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/canary.test.ts :31 secondaryBaseUrl: "http://5.6.7.8",
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer-mutation.test.ts :73 await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer-mutation.test.ts :152 const ok = await addUpstream(CLIENT, "http://5.6.7.8", 1000);
suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer-mutation.test.ts :154 const rejected = await addUpstream(CLIENT, "http://9.9.9.9", 1001);
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer.test.ts :39 await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer.test.ts :108 markTargetDown(`${CLIENT}#http://5.6.7.8`);
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/mcp-server-mutation-s3.test.ts :81 await registry.register(name, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/mcp-server-mutation-s4.test.ts :460 await registry.register(name, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/tool-search.test.ts :43 await registry.register(clientName, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 93.184.216.34 CarlxsMG-mcpbridge-f87ad2d/src/middleware/__tests__/ip-validator-mutation.test.ts :173 const result = await validateBackendUrl("http://93.184.216.34/", false, []);
suspicious endpoint 93.184.216.34 CarlxsMG-mcpbridge-f87ad2d/src/middleware/__tests__/ip-validator.test.ts :58 const result = await validateBackendUrl("http://93.184.216.34/", false, []);
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/observability/__tests__/tracing.test.ts :108 await registry.register("svc", [tool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/observability/__tests__/traffic.test.ts :24 await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/backends.test.ts :42 await registry.register(CLIENT, [gqlTool, wsTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/backends.test.ts :271 expect(await setToolWs(CLIENT, "wst", { enabled: true, wsUrl: "http://5.6.7.8" })).toMatchObject({
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-canary-cancel.test.ts :44 await registry.register(clientName, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-canary-cancel.test.ts :89 await setCanary(CLIENT, { secondaryBaseUrl: "http://9.9.9.9", mode: "canary", weight: 100, enabled: true });
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-graphql-probe.test.ts :50 await registry.register(clientName, [tool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-param-locations.test.ts :43 await registry.register(CLIENT, [tool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-guards.test.ts :25 await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-isdeleting-guard.test.ts :63 await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c1-pure-helpers.test.ts :38 await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4");
committed secret Google API key CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/guardrails-mutation-secrets.test.ts :128 AIza01…(39 chars, redacted)

code evidence vv1.1.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 809

filesystem 42

fs (weak) CarlxsMG-mcpbridge-f87ad2d/admin-ui/scripts/check-i18n.mjs :49 import fs from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/admin-ui/src/__tests__/i18n-parity.test.ts :20 import { readdirSync, readFileSync, statSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/admin-ui/src/__tests__/plurals.test.ts :15 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/admin-ui/src/__tests__/styles-defined.test.ts :24 import { readdirSync, readFileSync, statSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/docs/.vitepress/config.mts :1 import { existsSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/backup-restore.spec.ts :30 import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/cli-config-as-code.spec.ts :60 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/support/fixture-server.ts :38 import { readFileSync } from "node:fs";
fs CarlxsMG-mcpbridge-f87ad2d/playwright.config.ts :2 import { mkdtempSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/__tests__/bump-version.test.ts :1 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/bump-version.ts :20 import { readFileSync, writeFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/check-version-parity.ts :36 import { readFileSync } from "node:fs";

show 28 more

fs (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/extract-routes.ts :56 import { readdirSync, readFileSync, writeFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/generate.ts :31 import { readFileSync, writeFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/stryker-test-runner.ts :2 import { mkdirSync } from "fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/admin-ui-field-constraints.test.ts :19 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/config-schema.test.ts :2 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/dependency-overrides.test.ts :21 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/docs-seo.test.ts :19 import { readdirSync, readFileSync, statSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/no-control-bytes-in-source.test.ts :22 import { readdirSync, readFileSync, statSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/openapi-route-parity.test.ts :22 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/cli/__tests__/cli.test.ts :2 import { mkdtemp, rm } from "fs/promises";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/cli/__tests__/client-mutation.test.ts :22 import * as fsPromisesMod from "fs/promises";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/cli/__tests__/config-file-mutation.test.ts :2 import { mkdtemp, rm, writeFile } from "fs/promises";
fs CarlxsMG-mcpbridge-f87ad2d/src/cli/client.ts :3 import { mkdir, readFile, writeFile } from "fs/promises";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/cli/commands/__tests__/connect-mutation.test.ts :5 import * as fsPromisesMod from "fs/promises";
fs CarlxsMG-mcpbridge-f87ad2d/src/cli/commands/connect.ts :1 import { writeFile } from "fs/promises";
fs CarlxsMG-mcpbridge-f87ad2d/src/cli/config-file.ts :1 import { readFile, writeFile } from "fs/promises";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/db/__tests__/backup.test.ts :14 import { existsSync, rmSync, mkdtempSync } from "fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/db/__tests__/busy-timeout.test.ts :16 import { mkdtempSync, rmSync } from "fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/db/__tests__/leader-election.test.ts :3 import { existsSync, rmSync, mkdirSync, mkdtempSync } from "fs";
fs CarlxsMG-mcpbridge-f87ad2d/src/db/connection.ts :2 import { mkdirSync } from "fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/discovery/__tests__/openapi-discovery.test.ts :2 import { readFileSync } from "fs";
fs CarlxsMG-mcpbridge-f87ad2d/src/index.ts :13 import { existsSync } from "fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/registry-reload-on-boot.test.ts :16 import { existsSync, mkdirSync, rmSync, mkdtempSync } from "fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/scope-refusal-is-opaque.test.ts :21 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/observability/__tests__/usage-batching.test.ts :15 import { readFileSync } from "fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/deny-codes.test.ts :17 import { readFileSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/error-codes.test.ts :23 import { readFileSync, readdirSync, statSync } from "node:fs";
fs (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-backup-mutation.test.ts :13 import { existsSync, mkdirSync } from "fs";

2 more not shown — this panel samples each group; the count above is the real total.

shell / exec 9

shell (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/backup-restore.spec.ts :29 import { execSync } from "node:child_process";
shell (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/cli-config-as-code.spec.ts :57 import { spawn } from "node:child_process";
shell (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/check-all.ts :194 const probe = Bun.spawn([process.platform === "win32" ? "where" : "which", bin], {
shell (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/dev-all.ts :13 // Absolute path to THIS bun executable. On Windows, Bun.spawn(["bun", …]) can
shell (weak) CarlxsMG-mcpbridge-f87ad2d/scripts/stryker-test-runner.ts :10 * Stryker's built-in `command` test runner uses Node's `child_process.exec`,
shell (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/openapi-route-parity.test.ts :86 const result = Bun.spawnSync(["bun", EXTRACTOR_PATH, "--check"], { cwd: ROOT });
shell (weak) CarlxsMG-mcpbridge-f87ad2d/src/cli/__tests__/help.test.ts :15 const proc = Bun.spawn(["bun", CLI, ...args], { stdout: "pipe", stderr: "pipe" });
shell (weak) CarlxsMG-mcpbridge-f87ad2d/src/security/__tests__/bootstrap-admin.test.ts :604 const proc = Bun.spawn([BUN_EXE, ENTRYPOINT], {
shell CarlxsMG-mcpbridge-f87ad2d/stryker.config.mjs :21 // Stryker's `command` test runner uses Node's `child_process.exec`,

network 153

net (weak) CarlxsMG-mcpbridge-f87ad2d/admin-ui/src/composables/__tests__/useApi.test.ts :3 // the rest of rawFetch/apiFetch (real fetch(), CSRF header, JSON error parsing,
net CarlxsMG-mcpbridge-f87ad2d/admin-ui/src/composables/useApi.ts :74 const res = await fetch(path, { ...init, method, headers, credentials: "include" });
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/00-auth-fail-closed.spec.ts :68 const res = await fetch(`${APP_BASE_URL}/mcp/${serverName}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/approvals.spec.ts :363 await fetch(`${APP_BASE_URL}${session.path}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/bundles.spec.ts :103 const res = await fetch(`${APP_BASE_URL}${path}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/cli-config-as-code.spec.ts :58 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/consumer-quotas.spec.ts :267 const res = await fetch(`${APP_BASE_URL}${DATA_PLANE}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/control-plane.spec.ts :77 const res = await fetch(`${APP_BASE_URL}${path}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/graphql-client.spec.ts :117 const res = await fetch(`${APP_BASE_URL}${DATA_PLANE}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/guard-enforcement.spec.ts :112 await fetch(`${APP_BASE_URL}${session.path}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/health-eviction.spec.ts :172 const res = await fetch(`${FIXTURE_BASE_URL}${FIXTURE_CONTROL_PATH}/${action}`, { method: "POST" });
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/install-links.spec.ts :180 const res = await fetch(`${APP_BASE_URL}/install/${token}`);

show 28 more

net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/mcp-protocol.spec.ts :75 const res = await fetch(`${APP_BASE_URL}${DATA_PLANE}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/mcp-sessions.spec.ts :134 const res = await fetch(`${APP_BASE_URL}${path}`, { method: "POST", headers, body: JSON.stringify(body) });
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/mcp-upstream.spec.ts :41 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/response-cache.spec.ts :166 await fetch(`${APP_BASE_URL}${DATA_PLANE}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/response-sanitization.spec.ts :132 await fetch(`${APP_BASE_URL}${path}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/sso-oidc.spec.ts :147 return fetch(`${APP_BASE_URL}${path}`, { redirect: "manual" });
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/support/fixture-server.ts :37 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/e2e/support/mcp.ts :57 const initRes = await fetch(`${APP_BASE_URL}${path}`, {
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/_utils/app.ts :23 import type { Server } from "node:http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/create-app.test.ts :15 import type { AddressInfo } from "net";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/health.test.ts :13 import type { Server } from "http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/json-depth-mounted.test.ts :11 import type { AddressInfo } from "net";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/request-id-mcp-passthrough.test.ts :26 import type { Server } from "http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/server-mutation.test.ts :29 import type { Server } from "http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/__tests__/ws-proxy-mutation.test.ts :36 import type { AddressInfo } from "net";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/admin/audit/__tests__/audit-chain.test.ts :6 import type { AddressInfo } from "net";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/anomaly.test.ts :6 import type { AddressInfo } from "net";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/rbac.test.ts :8 import type { Server } from "http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/schedules.test.ts :10 import type { Server } from "http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/teams.test.ts :10 import type { Server } from "http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/admin/tool-composition/__tests__/composites.test.ts :9 import type { Server as HttpServer } from "http";
net CarlxsMG-mcpbridge-f87ad2d/src/cli/client.ts :56 const res = await fetch(`${base}${path}`, {
net CarlxsMG-mcpbridge-f87ad2d/src/config.ts :220 /** Timeout for a JWKS fetch (ms). */
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/db/__tests__/backup.test.ts :12 import type { Server } from "http";
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/discovery/__tests__/graphql-discovery-mutation-gd4.test.ts :181 // L244:37-250:4 ObjectLiteral (whole fetch() options object emptied) +
net CarlxsMG-mcpbridge-f87ad2d/src/discovery/graphql-discovery.ts :293 const res = pinnedFetch ? await pinnedFetch(graphqlUrl, fetchInit) : await fetch(graphqlUrl, fetchInit);
net CarlxsMG-mcpbridge-f87ad2d/src/discovery/openapi-discovery.ts :31 const res = pinnedFetch ? await pinnedFetch(openapiUrl, fetchInit) : await fetch(openapiUrl, fetchInit);
net (weak) CarlxsMG-mcpbridge-f87ad2d/src/lib/__tests__/webhook-mutation.test.ts :112 expect(fetchCalls.length).toBe(0); // the early-return branch must never reach fetch()

113 more not shown — this panel samples each group; the count above is the real total.

secrets 1

secrets CarlxsMG-mcpbridge-f87ad2d/src/config.ts :286 corsAllowCredentials: process.env.CORS_ALLOW_CREDENTIALS === "true",

install hooks 1

prepare CarlxsMG-mcpbridge-f87ad2d/package.json :31 lefthook install

declared dependencies 27

@modelcontextprotocol/sdk@^1.12.0
@scalar/openapi-parser@^0.25.6
ajv@8.18.0
ajv-formats@^3.0.1
express@^5.1.0
ipaddr.js@^2.4.0
swagger-ui-express@^5.0.1
ws@^8.21.0
yaml@^2.7.1
zod@4.3.6
@commitlint/cli@^21.2.1
@commitlint/config-conventional@^21.2.0

show 15 more

@eslint/js@^10.0.1
@playwright/test@^1.61.1
@stryker-mutator/core@^10.0.0
@stryker-mutator/typescript-checker@^10.0.0
@types/express@^5.0.0
@types/swagger-ui-express@^4.1.8
@types/ws@^8.18.1
bun-types@1.3.11
eslint@^10.6.0
eslint-config-prettier@^10.1.8
lefthook@^2.1.10
openapi-types@^12.1.3
prettier@^3.9.4
typescript@^5.9.0
typescript-eslint@^8.62.1

obfuscation 3

dynamic require()/import() CarlxsMG-mcpbridge-f87ad2d/e2e/cli-config-as-code.spec.ts :281 await import(${JSON.stringify(pathToFileURL(CLI_ENTRY).href)});
dynamic require()/import() CarlxsMG-mcpbridge-f87ad2d/src/__tests__/config-mutation.test.ts :168 const mod = (await import(`../config.js?configmutationtest=${importCounter}`)) as { config: AnyConfig };
dynamic require()/import() CarlxsMG-mcpbridge-f87ad2d/src/__tests__/config-parsers.test.ts :169 const mod = (await import(`../config.js?trustproxytest=${importCounter}`)) as {

perm:untrusted 17

untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/teams.test.ts :153 const list1 = (await (await fetch(`${baseUrl}/admin-api/clients`, { headers: { Cookie: u1 } })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-alerts.test.ts :65 const list = (await (await fetch(`${baseUrl}/admin-api/alerts`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-audit-log-mutation.test.ts :152 const page1 = (await (await fetch(`${baseUrl}/admin-api/audit-log?limit=1`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-bundles-mutation.test.ts :477 const detail = (await (await fetch(`${baseUrl}/admin-api/bundles/b`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-bundles.test.ts :211 const detail = (await (await fetch(`${baseUrl}/admin-api/bundles/b`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-catalog-mutation.test.ts :594 const list = (await (await fetch(`${adminBase}/admin-api/catalog`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-catalog.test.ts :142 const list = (await (await fetch(`${adminBase}/admin-api/catalog`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-clients-mutation.test.ts :183 const page1 = (await (await fetch(`${baseUrl}/admin-api/clients?limit=1`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-consumers.test.ts :60 const list = (await (await fetch(`${baseUrl}/admin-api/consumers`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-llms.test.ts :102 const body = await (await fetch(`${baseUrl}/llms.txt`)).text();
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-metrics-mutation.test.ts :136 const first = await (await fetch(`${baseUrl}/metrics`, { headers: bearer() })).text();
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-policies.test.ts :74 const list = (await (await fetch(`${baseUrl}/admin-api/policies`, { headers: bearer() })).json()) as {

show 5 more

untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-schedules-mutation.test.ts :536 const get = (await (await fetch(`${baseUrl}/admin-api/schedules`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-tags.test.ts :78 const tags = (await (await fetch(`${baseUrl}/admin-api/tags`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-teams-mutation.test.ts :271 const get = (await (await fetch(`${baseUrl}/admin-api/teams`, { headers: bearer() })).json()) as {
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-traffic-mutation.test.ts :243 const withoutFilter = await (await fetch(`${baseUrl}/admin-api/traffic`, { headers: bearer() })).json();
untrusted (weak) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-usage.test.ts :51 const summary = await (await fetch(`${baseUrl}/admin-api/usage/summary`, { headers: bearer() })).json();