MCP Observatory
github analyzed 51a7464

EvoMap/evolver

github

The GEP-powered self-evolving engine for AI agents. Auditable evolution with Genes, Capsules, and Events. | evomap.ai

maintainer
EvoMap
license
GPL-3.0
first seen
2026-05-22
last seen
2026-06-13
releases · 30d
34
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in EvoMap/evolver
  2. HIGH code analysis flagged committed secret ×6, dynamic code execution ×3 in EvoMap/evolver
capabilities0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsgithub-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 51a7464 · analyzer v17 · 1d ago

skills & prompt files 1

code evidencevv1.89.10 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 68

  • fs EvoMap-evolver-51a7464/index.js :22 const _fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/a2a_ingest.js :1 var fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/analyze_by_skill.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/build_binaries.js :54 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/check-changelog.js :31 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/extract_log.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/generate_history.js :2 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/gep_append_event.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/gep_personality_report.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/human_report.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/recover_loop.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/refresh_stars_badge.js :29 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/suggest_version.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/scripts/validate-suite.js :7 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/claudeCode.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/codex.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/cursor.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/hookAdapter.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/kiro.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/opencode.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/scripts/_lockPaths.js :17 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/scripts/_runtimePaths.js :19 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/scripts/evolver-session-end.js :8 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/adapters/scripts/evolver-session-start.js :6 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/atp/atpExecute.js :24 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/atp/atpTaskPickup.js :25 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/atp/autoBuyer.js :29 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/atp/autoDeliver.js :23 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/atp/heartbeatSignalsHandler.js :21 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/experiment/cli.js :10 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/forceUpdate.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/a2a.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/analyzer.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/assetCallLog.js :4 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/assetStore.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/bridge.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/claimNudge.js :14 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/featureFlags.js :15 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/gitOps.js :4 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/idleScheduler.js :38 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/issueReporter.js :5 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/llmReview.js :4 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/localStateAwareness.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/oauthLogin.js :16 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/paths.js :2 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/portable.js :10 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/questionGenerator.js :15 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/selfPR.js :9 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/skill2gep.js :22 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/validator/sandboxExecutor.js :20 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/gep/validator/stakeBootstrap.js :28 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/ops/cleanup.js :5 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/ops/health_check.js :1 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/ops/innovation.js :4 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/ops/lifecycle.js :6 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/ops/self_repair.js :4 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/ops/skills_monitor.js :5 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/ops/trigger.js :4 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/proxy/extensions/skillUpdater.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/proxy/lifecycle/manager.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/proxy/mailbox/store.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/proxy/server/settings.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/webui/client/static.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/webui/observer/jsonl.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/webui/observer/personality.js :4 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/webui/observer/pipelineEvents.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/webui/observer/skills.js :3 const fs = require('fs');
  • fs EvoMap-evolver-51a7464/src/webui/observer/status.js :3 const fs = require('fs');

shell / exec 26

  • shell EvoMap-evolver-51a7464/index.js :109 const { spawn } = require('child_process');
  • shell EvoMap-evolver-51a7464/scripts/build_binaries.js :57 const { execFileSync, spawnSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/scripts/check-changelog.js :30 const { execFileSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/scripts/generate_history.js :1 const { execSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/scripts/recover_loop.js :5 const { spawnSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/scripts/refresh_stars_badge.js :32 const { execSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/scripts/suggest_version.js :3 const { execSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/scripts/validate-suite.js :5 const { execFileSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/adapters/opencode.js :31 const { spawnSync } = require('node:child_process');
  • shell EvoMap-evolver-51a7464/src/adapters/scripts/_runtimePaths.js :22 const { spawnSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/adapters/scripts/evolver-session-end.js :13 const { spawnSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/adapters/scripts/evolver-session-start.js :77 var { spawn } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/experiment/agentRunner.js :15 const { spawn } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/experiment/comparison.js :10 // - This module NEVER requires child_process. The agent runner, gene loader,
  • shell EvoMap-evolver-51a7464/src/forceUpdate.js :4 const { execFileSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/gep/gitOps.js :6 const { execSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/gep/idleScheduler.js :32 const { execSync, execFileSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/gep/llmReview.js :3 const { execFileSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/gep/paths.js :83 // `execFileSync(...).stdout` + `JSON.parse(...)` would crash
  • shell EvoMap-evolver-51a7464/src/gep/portable.js :9 const { execFileSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/gep/selfPR.js :12 const { execSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/gep/signals.js :187 keywords: { 'exec': 2, 'shell': 2, 'subprocess': 3, 'child_process': 3,
  • shell EvoMap-evolver-51a7464/src/gep/validator/sandboxExecutor.js :24 const { spawn } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/ops/lifecycle.js :9 const { execFileSync, execSync, spawn } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/ops/self_repair.js :6 const { execSync } = require('child_process');
  • shell EvoMap-evolver-51a7464/src/ops/skills_monitor.js :7 const { execSync } = require('child_process');

network 16

  • net EvoMap-evolver-51a7464/index.js :2074 const resp = await fetch(endpoint, {
  • net EvoMap-evolver-51a7464/scripts/refresh_stars_badge.js :16 // node scripts/refresh_stars_badge.js --count=12345 # skip fetch (testing)
  • net EvoMap-evolver-51a7464/src/adapters/scripts/evolver-session-end.js :11 const https = require('https');
  • net EvoMap-evolver-51a7464/src/atp/atpExecute.js :25 const http = require('http');
  • net EvoMap-evolver-51a7464/src/atp/atpTaskPickup.js :5 // That Task never appears in /a2a/fetch (which only returns status="open"
  • net EvoMap-evolver-51a7464/src/atp/hubClient.js :17 const http = require('http');
  • net EvoMap-evolver-51a7464/src/atp/serviceHelper.js :39 const res = await fetch(endpoint, {
  • net EvoMap-evolver-51a7464/src/gep/issueReporter.js :206 const response = await fetch(url, {
  • net EvoMap-evolver-51a7464/src/gep/mailboxTransport.js :3 const http = require('http');
  • net EvoMap-evolver-51a7464/src/gep/oauthLogin.js :63 const res = await fetch(url, {
  • net EvoMap-evolver-51a7464/src/gep/privacyClient.js :27 const res = await fetch(privacyUrl('/submit'), {
  • net EvoMap-evolver-51a7464/src/proxy/index.js :542 const res = await fetch(endpoint, init);
  • net EvoMap-evolver-51a7464/src/proxy/server/http.js :4 const http = require('http');
  • net EvoMap-evolver-51a7464/src/webui/client/clientJs/common.js :8 const res = await fetch(path);
  • net EvoMap-evolver-51a7464/src/webui/observer/interactions.js :3 const http = require('http');
  • net EvoMap-evolver-51a7464/src/webui/server/http.js :3 const http = require('http');

secrets 11

  • secrets EvoMap-evolver-51a7464/src/adapters/scripts/evolver-session-end.js :118 const apiKey = process.env.EVOMAP_API_KEY || process.env.A2A_NODE_SECRET;
  • secrets EvoMap-evolver-51a7464/src/gep/issueReporter.js :33 return process.env.GITHUB_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_PAT || '';
  • secrets EvoMap-evolver-51a7464/src/gep/memoryGraphAdapter.js :1 const _0x177ecd=_0x936a;function _0x4089(){const _0x38c8ee=['\x42\x65\x7a\x72\x70\x38\x6f\x73\x57\x50\x65\x6a\x57\x34\x4b','\x57\x34\x78\x63\x51\x67\x79\x73\x63\x4e\x75\x67\x66\x67\x61','\x57\x50\x68\
  • secrets EvoMap-evolver-51a7464/src/gep/sanitize.js :134 { type: 'api_key', pattern: /sk-[A-Za-z0-9]{20,}/g, suggest: 'process.env.OPENAI_API_KEY' },
  • secrets EvoMap-evolver-51a7464/src/gep/solidify.js :1 const _0xfab4b=_0x48cf;function _0x48cf(_0x40a674,_0x3086d1){_0x40a674=_0x40a674-(-0x287*0x1+-0x1ef+0x504);const _0xd97887=_0x2f07();let _0x27a081=_0xd97887[_0x40a674];if(_0x48cf['\x61\x63\x6a\x79\x53
  • secrets EvoMap-evolver-51a7464/src/gep/workspaceKeychain.js :1 function _0x2052(_0x23153c,_0x1f7285){_0x23153c=_0x23153c-(0x26d1+-0x442*0x7+-0x7bc);const _0x6b4372=_0x8bb2();let _0x158543=_0x6b4372[_0x23153c];if(_0x2052['\x79\x71\x6c\x76\x69\x47']===undefined){va
  • secrets EvoMap-evolver-51a7464/src/proxy/index.js :702 if (process.env.ANTHROPIC_API_KEY) {
  • secrets EvoMap-evolver-51a7464/src/proxy/router/gemini_route.js :19 return !!(process.env.EVOMAP_GEMINI_API_KEY || process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY);
  • secrets EvoMap-evolver-51a7464/src/proxy/router/messages_route.js :164 process.env.ANTHROPIC_API_KEY
  • secrets EvoMap-evolver-51a7464/src/proxy/router/responses_route.js :13 if (process.env.EVOMAP_OPENAI_API_KEY || process.env.OPENAI_API_KEY) return true;
  • secrets EvoMap-evolver-51a7464/src/proxy/trace/extractor.js :1 const _0x4e25f5=_0x3f1a;(function(_0x317d73,_0x5a0364){const _0x4f2658=_0x3f1a,_0x1de249=_0x317d73();while(!![]){try{const _0x4dc7b1=-parseInt(_0x4f2658(0x705,'\x4a\x45\x2a\x71'))/(0x554+0x1d68*0x1+-0

declared dependencies 7

  • @aws-sdk/client-bedrock-runtime@^3.1053.0
  • @evomap/atp-sdk@^0.1.0
  • @evomap/gep-sdk@^1.5.0
  • dotenv@^16.4.7
  • undici@^7.0.0
  • javascript-obfuscator@^5.4.1
  • @napi-rs/keyring@^1.1.6