MCP Observatory
1m ago Tracked 55,861 Last 1m ago 24h 2,736
github Rust analyzed c4fe4ae deep scan unknown unconfirmed MCP

CueCrux/Crux

github

Retrieval engine with cryptographic receipts. Token-budgeted search, fact store, gap reporting. Single binary, runs anywhere.

maintainer
CueCrux
licence
Apache-2.0
first seen
2026-07-10
last seen
2026-08-26
releases · 30d
3
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  2. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  3. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  4. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  5. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  6. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  7. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  8. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  9. HIGH code analysis flagged committed secret ×7 in CueCrux/Crux
  10. HIGH code analysis flagged committed secret ×6 in CueCrux/Crux
  11. HIGH code analysis flagged committed secret ×6 in CueCrux/Crux
  12. HIGH code analysis flagged committed secret ×8, dynamic code execution in CueCrux/Crux
  13. HIGH code analysis flagged committed secret ×8, dynamic code execution in CueCrux/Crux
  14. HIGH code analysis flagged committed secret ×6, dynamic code execution in CueCrux/Crux
  15. HIGH code analysis flagged committed secret ×6, dynamic code execution in CueCrux/Crux
  16. HIGH code analysis flagged committed secret ×6, dynamic code execution in CueCrux/Crux
  17. HIGH code analysis flagged committed secret ×6, dynamic code execution in CueCrux/Crux
capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit c4fe4ae · analyzer v33 · 3d ago

skills & prompt files 40

danger signals11

code evidence vv0.5.64 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1112

filesystem 3

  • fs CueCrux-Crux-c4fe4ae/UI-prototype/console-3d/tools/verify.cjs :5 const fs = require('fs');
  • fs CueCrux-Crux-c4fe4ae/UI-prototype/console-smoke.cjs :5 const fs = require('fs'), vm = require('vm');
  • fs CueCrux-Crux-c4fe4ae/crates/corecruxd/console/v2/smoke.cjs :63 const fs = require('fs');

network 5

  • net CueCrux-Crux-c4fe4ae/crates/corecruxd/console/v2/api.js :184 return fetch(withQuery(path, query), { credentials: 'same-origin' });
  • net CueCrux-Crux-c4fe4ae/crates/corecruxd/console/v2/smoke.cjs :421 // The ONLY shipped v2 file allowed to call fetch() is the generated api.js;
  • net CueCrux-Crux-c4fe4ae/crates/corecruxd/console/v2/sw.js :93 var network = fetch(req).then(function (resp) {
  • net CueCrux-Crux-c4fe4ae/sdks/typescript/src/index.ts :659 const response = await fetch(url, init);
  • net (weak) CueCrux-Crux-c4fe4ae/sdks/typescript/test/client.test.mjs :17 import { createServer } from "node:http";

install hooks 42

  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/call-bind-apply-helpers/package.json :16 npmignore --auto --commentLines=auto
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/call-bind-apply-helpers/package.json :18 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/call-bound/package.json :12 npmignore --auto --commentLines=auto
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/call-bound/package.json :14 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/dunder-proto/package.json :13 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/dunder-proto/package.json :15 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/es-define-property/package.json :13 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/es-define-property/package.json :15 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/es-errors/package.json :18 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/es-errors/package.json :19 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/es-object-atoms/package.json :15 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/es-object-atoms/package.json :16 safe-publish-latest
show 28 more
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/function-bind/package.json :47 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/function-bind/package.json :49 npmignore --auto --commentLines=autogenerated
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/get-intrinsic/package.json :12 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/get-intrinsic/package.json :14 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/get-proto/package.json :13 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/get-proto/package.json :15 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/gopd/package.json :13 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/gopd/package.json :14 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/has-symbols/package.json :7 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/has-symbols/package.json :8 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/hasown/package.json :13 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/hasown/package.json :15 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/math-intrinsics/package.json :26 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/math-intrinsics/package.json :27 safe-publish-latest
  • prepare CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/mime/package.json :29 node src/build.js
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/object-inspect/package.json :34 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/object-inspect/package.json :36 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/qs/package.json :72 npmignore --auto --commentLines=autogenerated && npm run dist
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/qs/package.json :73 safe-publish-latest
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/setprototypeof/package.json :16 npm t
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel-list/package.json :12 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel-list/package.json :13 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel-map/package.json :12 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel-map/package.json :13 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel-weakmap/package.json :12 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel-weakmap/package.json :13 safe-publish-latest
  • prepack CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel/package.json :12 npmignore --auto --commentLines=autogenerated
  • prepublishOnly CueCrux-Crux-c4fe4ae/crates/corecruxd/console/assets/crux.mcpb!/server/node_modules/side-channel/package.json :13 safe-publish-latest

2 more not shown — this panel samples each group; the count above is the real total.

declared dependencies 57

  • typescript@^5.7
  • anyhow@1.0.97
  • axum@0.8.9
  • base64@0.23.0
  • blake3@1.8.5
  • chacha20poly1305@0.11.0
  • chrono@0.4.45
  • ciborium@0.2.2
  • clap@4.6.1
  • crc32c@0.6.8
  • crc32fast@1.4.2
  • data-encoding@2.9.0
show 28 more
  • ed25519-dalek@2.2.0
  • fs2@0.4.3
  • hex@0.4.3
  • http-body-util@0.1.3
  • jsonwebtoken@11.0.0
  • lz4_flex@0.14.0
  • p256@0.14.0
  • prometheus@0.13.4
  • proptest@1.6.0
  • prost@0.14.4
  • rand@0.10.1
  • rcgen@0.14.8
  • regex@1.11
  • roxmltree@=0.21.1
  • rustix@1.1.4
  • serde@1.0.218
  • serde_json@1.0.150
  • serde_yaml@0.9.34
  • serial_test@3
  • sha2@0.11
  • subtle@2
  • syn@3.0.0
  • proc-macro2@1.0
  • tar@0.4.44
  • tempfile@3.16.0
  • thiserror@2.0.12
  • tokio@1.52.3
  • tokio-stream@0.1.17

17 more not shown — this panel samples each group; the count above is the real total.

perm:untrusted 1

  • untrusted CueCrux-Crux-c4fe4ae/crates/corecruxd/console/v2/sw.js :93 var network = fetch(req).then(function (resp) {