Two OSS products on one rrweb substrate: tracelane (self-contained HTML test-failure replays for WDIO/Playwright/Cypress) + peek (local-first browser-session forensics + repro for AI coding agents, over MCP). No SaaS, no telemetry, local-first.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http
verified
reported
listed in the official MCP registry counts 21 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
clear_highlight
-
execute_action
-
generate_playwright_repro
-
get_dom_snapshot
-
get_element_detail
-
get_page_view
-
get_session_console_errors
-
get_session_network_errors
-
get_session_summary
-
get_user_action_before_error
-
list_recent_sessions
-
query_dom_history
-
render_session_journey
-
request_authorization
-
request_pairing
-
request_user_input
-
search_sessions
-
set_intent
-
share_session
-
suggest_element
-
verify_audit_log
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 99d7e1e · analyzer v33 · 2w ago
skills & prompt files 3
danger signals11
- dynamic code execution new Function() Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/src/__tests__/action-feedback.test.ts :140
return new Function(`return (${fn.toString()})`)() as T; - dynamic code execution new Function() Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/src/__tests__/dispatcher.test.ts :292
return new Function(`return (${fn.toString()})`)() as T; - dynamic code execution new Function() Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/src/__tests__/highlight.test.ts :80
return new Function(`return (${fn.toString()})`)() as T; - dynamic code execution new Function() Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/src/__tests__/snapshot.test.ts :181
const reconstructed = new Function( - dynamic code execution eval() Cubenest-rrweb-stack-99d7e1e/packages/tracelane-core/test/mode.test.ts :12
eval(code); - dynamic code execution eval() Cubenest-rrweb-stack-99d7e1e/packages/tracelane-core/test/recorder-drain.test.ts :19
eval(code); - dynamic code execution eval() Cubenest-rrweb-stack-99d7e1e/packages/tracelane-core/test/recorder-navigation.test.ts :26
eval(code); - dynamic code execution eval() Cubenest-rrweb-stack-99d7e1e/packages/tracelane-core/test/recorder-network-plugin.test.ts :27
eval(code); - dynamic code execution new Function() Cubenest-rrweb-stack-99d7e1e/packages/tracelane-playwright/src/playwright-executor.ts :39
const f = new Function(`return (${packed.body}).apply(null, arguments[0]);`); - committed secret Slack token Cubenest-rrweb-stack-99d7e1e/packages/connector-core/src/prompt.test.ts :32
xoxb-m…(17 chars, redacted) - committed secret Slack token Cubenest-rrweb-stack-99d7e1e/packages/connector-slack/src/bootstrap.test.ts :116
xoxb-f…(15 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 571
filesystem 128
- fs (weak) Cubenest-rrweb-stack-99d7e1e/apps/peek-docs/scripts/bundle-demo.mjs :5
import { cpSync, rmSync } from 'node:fs' - fs (weak) Cubenest-rrweb-stack-99d7e1e/docs/qa/fixtures/tracelane-demo/wdio.conf.ts :7
import { readFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/connector-core/src/runtime.test.ts :1
import { mkdtemp, rm, writeFile } from 'node:fs/promises'; - fs Cubenest-rrweb-stack-99d7e1e/packages/connector-core/src/runtime.ts :1
import { rm } from 'node:fs/promises'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/connector-core/src/secret-store.test.ts :1
import { mkdir, rm, stat, writeFile } from 'node:fs/promises'; - fs Cubenest-rrweb-stack-99d7e1e/packages/connector-core/src/secret-store.ts :1
import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/connector-slack/scripts/postbuild.mjs :4
import { chmodSync, existsSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/connector-slack/src/slack-adapter.ts :1
import { readFile } from 'node:fs/promises'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/_launch-render-cws.mjs :20
import { globSync, mkdirSync, readFileSync, statSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/_launch-render.mjs :25
import { globSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/check-plugin.mjs :1
import { readFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/gen-security-demo.mjs :5
import { mkdirSync, writeFileSync } from 'node:fs';
show 28 more
- fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/verify-recipes-live.mjs :22
import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/verify-recipes-wdio.mjs :37
} from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/verify-recipes.mjs :29
import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/scripts/postbuild.mjs :9
import { chmodSync, cpSync, existsSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/audit-bundle.ts :3
import { existsSync, readFileSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/audit-verify.ts :11
import { existsSync, readFileSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/audit.ts :8
import { readFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/connect.test.ts :6
import { mkdtempSync, rmSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/connect.ts :8
import { closeSync, mkdirSync, openSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/init.ts :9
import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/sessions.bundle.test.ts :1
import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/sessions.import.test.ts :1
import { readFileSync, writeFileSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/sessions.ts :16
import { writeFileSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/status.ts :6
import { existsSync, statSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/audit-bundle.ts :5
import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/logs.test.ts :6
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/logs.ts :5
import { createReadStream, watch as fsWatch, readdirSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/registry.test.ts :1
import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/registry.ts :6
import { readFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/status.test.ts :5
import { mkdtempSync, rmSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/status.ts :9
import { mkdirSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/supervisor-lock.test.ts :4
import { rmSync, writeFileSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/connect/supervisor-lock.ts :9
import { closeSync, openSync, readFileSync, unlinkSync, writeSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/db.ts :10
import { rmSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/entrypoint.ts :16
import { realpathSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/fs-atomic.ts :6
import { mkdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'; - fs (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/import-session.test.ts :1
import { existsSync, mkdtempSync, rmSync } from 'node:fs'; - fs Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/import-session.ts :6
import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
88 more not shown — this panel samples each group; the count above is the real total.
shell / exec 12
- shell (weak) Cubenest-rrweb-stack-99d7e1e/apps/peek-docs/scripts/bundle-demo.mjs :4
import { execSync } from 'node:child_process' - shell (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/verify-recipes-wdio.mjs :28
import { spawn } from 'node:child_process'; - shell (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/verify-recipes.mjs :28
import { execSync } from 'node:child_process'; - shell Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/connect.ts :7
import { spawn as _realSpawn } from 'node:child_process'; - shell (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/e2e/smoke.spec.ts :41
import { spawn } from 'node:child_process'; - shell Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/index.ts :12
// - `peek-mcp` (default): run the stdio MCP server AI tools spawn (Phase 3c). - shell Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/native-host/installer.ts :18
import { execFileSync } from 'node:child_process'; - shell (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/stdio-smoke.test.ts :10
import { type ChildProcessWithoutNullStreams, spawn } from 'node:child_process'; - shell Cubenest-rrweb-stack-99d7e1e/packages/tracelane-cli/src/commands/init.ts :21
import { type SpawnSyncReturns, spawnSync } from 'node:child_process'; - shell (weak) Cubenest-rrweb-stack-99d7e1e/packages/tracelane-cli/test/init.test.ts :3
// invokes runInitProgrammatic with the fixture's cwd + a stubbed spawn (so - shell (weak) Cubenest-rrweb-stack-99d7e1e/packages/tracelane-playwright/e2e/run.mjs :16
import { spawnSync } from 'node:child_process'; - shell (weak) Cubenest-rrweb-stack-99d7e1e/packages/tracelane-playwright/scripts/gen-demo-report.mjs :22
import { spawn, spawnSync } from 'node:child_process';
network 10
- net (weak) Cubenest-rrweb-stack-99d7e1e/docs/qa/fixtures/tracelane-demo/tests/failing.spec.ts :24
// Click → console.log + fetch('/api/will-fail') → 404. - net (weak) Cubenest-rrweb-stack-99d7e1e/docs/qa/fixtures/tracelane-demo/wdio.conf.ts :8
import { type Server, createServer } from 'node:http'; - net (weak) Cubenest-rrweb-stack-99d7e1e/packages/docs-shared/scripts/_launch-render-cws.mjs :21
import { createServer } from 'node:http'; - net Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/vitest.config.ts :11
// into `fetch()` calls that throw "Failed to parse URL". Instead, `setup.ts` - net Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/host-bridge.ts :31
import * as net from 'node:net'; - net Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/native-host/host-socket.ts :26
import * as net from 'node:net'; - net (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/host-socket.test.ts :3
import * as net from 'node:net'; - net (weak) Cubenest-rrweb-stack-99d7e1e/packages/rrweb-core/test/plugins-network.test.ts :258
// Default opts don't wrap fetch (no body/headers requested), so we - net Cubenest-rrweb-stack-99d7e1e/packages/tracelane-playwright/demo/serve.mjs :13
import { createServer } from 'node:http'; - net (weak) Cubenest-rrweb-stack-99d7e1e/packages/tracelane-wdio/e2e/wdio.conf.ts :13
import { type Server, createServer } from 'node:http';
database 22
- db Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/commands/sessions.ts :26
import type { Database } from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/db.ts :12
import type { Database } from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/import-session.ts :10
import type { Database } from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/src/lib/status.ts :15
import type { Database } from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/test/db.test.ts :5
import type { Database } from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/test/prune-apply.test.ts :5
import type { Database } from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/test/prune-select.test.ts :5
import type { Database } from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-cli/test/search-sessions.test.ts :1
import Database from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/e2e/smoke.spec.ts :48
import Database from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/db/migrate.ts :8
import type { Database } from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/db/open.ts :9
import type Database from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/event-blobs.ts :12
import type { Database } from 'better-sqlite3';
show 10 more
- db Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/queries.ts :8
import type { Database } from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :24
import type { Database } from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/summary.ts :7
import type { Database } from 'better-sqlite3'; - db Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/native-host/ingest.ts :25
import type { Database } from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/ingest.test.ts :16
import type { Database } from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/migrate.test.ts :4
import Database from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/queries.test.ts :6
import type { Database } from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/scaffold.test.ts :5
import Database from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/search-sessions.test.ts :1
import Database from 'better-sqlite3'; - db (weak) Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/test/summary.test.ts :1
import type { Database } from 'better-sqlite3';
tool registrations 21
- list_recent_sessions Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :254
- search_sessions Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :306
- get_session_summary Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :390
- get_session_console_errors Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :414
- get_session_network_errors Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :459
- get_user_action_before_error Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :507
- render_session_journey Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :555
- generate_playwright_repro Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :623
- get_dom_snapshot Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :680
- query_dom_history Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :724
- request_authorization Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :799
- execute_action Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :837
show 9 more
- suggest_element Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :888
- clear_highlight Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :924
- set_intent Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :957
- request_user_input Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :1005
- get_page_view Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :1082
- get_element_detail Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :1128
- verify_audit_log Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :1159
- request_pairing Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :1190
- share_session Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/src/mcp/server.ts :1222
install hooks 2
- postinstall Cubenest-rrweb-stack-99d7e1e/packages/peek-extension/package.json :17
wxt prepare - postinstall Cubenest-rrweb-stack-99d7e1e/packages/peek-mcp/package.json :66
node ./scripts/postinstall-guard.mjs
declared dependencies 5
- @biomejs/biome@^1.9.4
- @changesets/cli@^2.27.10
- lefthook@^2.1.9
- typescript@^6.0.3
- vitest@^3.2.6