MCP Observatory
5m ago Tracked 58,253 Last 5m ago 24h 2,671
github PHP analyzed 38cec1b

Gadsotek/artifactflow

github

Open-source, self-hosted, versioned vault for AI-generated HTML, Markdown, Mermaid, and image artifacts, with scoped MCP access and isolated two-origin previews.

maintainer
Gadsotek
licence
AGPL-3.0
first seen
2026-07-28
last seen
2026-09-15
releases · 30d
5
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  2. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  3. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  4. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  5. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  6. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  7. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  8. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  9. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  10. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  11. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  12. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  13. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  14. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  15. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  16. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  17. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  18. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  19. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
  20. HIGH code analysis flagged committed secret in Gadsotek/artifactflow
capabilities 0 tools
transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 38cec1b · analyzer v33 · 37m ago

skills & prompt files 2

danger signals1

code evidence vv0.3.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1289

filesystem 16

  • fs Gadsotek-artifactflow-38cec1b/resources/build/mermaid-licenses.js :1 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/scripts/license-audit/verify-dependency-licenses.mjs :3 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/scripts/publish-guard.test.mjs :13 } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/scripts/quality-images.test.mjs :2 import { mkdtempSync, readFileSync, writeFileSync, unlinkSync, rmdirSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/scripts/verify-dompurify.mjs :14 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/scripts/verify-mcp-remote.mjs :1 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/auth-security.spec.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/editor.spec.ts :5 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/marketing-screenshots.spec.ts :4 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/mermaid-security.spec.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/office-artifact-flow.spec.ts :4 import { readFileSync } from 'node:fs';
  • fs (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/pdf-artifact-flow.spec.ts :4 import { readFileSync } from 'node:fs';
show 4 more
  • fs Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/src/start-server.cjs :3 const fs = require('node:fs');
  • fs (weak) Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/test/processor-protocol.test.cjs :5 const fs = require('node:fs');
  • fs (weak) Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/test/server-startup.test.cjs :5 const fs = require('node:fs');
  • fs (weak) Gadsotek-artifactflow-38cec1b/xlsx-viewer-spike/test/viewer-source-contract.test.mjs :2 import { readFile } from 'node:fs/promises';

shell / exec 19

  • shell (weak) Gadsotek-artifactflow-38cec1b/scripts/publish-guard.test.mjs :2 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/scripts/quality-images.test.mjs :6 import { spawnSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/scripts/smoke-mcp-remote.mjs :1 import { spawn } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/access-autocomplete.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/artifact-cookie-isolation.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/artifact-egress-matrix.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/artifact-parser-differential-fuzz.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/editor.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/external-sharing.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/home-layout.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/library-hierarchy.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/marketing-screenshots.spec.ts :2 import { execFileSync } from 'node:child_process';
show 7 more
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/office-artifact-flow.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/pdf-artifact-flow.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/personal-navigation.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/saved-artifact-preview.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/workspace-hierarchy.spec.ts :2 import { execFileSync } from 'node:child_process';
  • shell Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/src/processor-protocol.cjs :7 const { spawn } = require('node:child_process');
  • shell (weak) Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/test/server-startup.test.cjs :9 const { spawn } = require('node:child_process');

network 22

  • net (weak) Gadsotek-artifactflow-38cec1b/pdf-processor-spike/browser-fixture.mjs :1 import { createServer } from 'node:http';
  • net Gadsotek-artifactflow-38cec1b/resources/js/artifact-preview-refresh.js :78 const response = await fetch(endpoint, options);
  • net Gadsotek-artifactflow-38cec1b/resources/js/content-editor.js :137 response = await fetch(form.action, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/external-share-bootstrap.js :139 const response = await fetch(`/external-shares/${encodeURIComponent(selector)}/open`, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/external-share-management.js :232 const response = await fetch(form.action, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/external-share-viewer.js :90 const response = await fetch(endpoint, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/html-draft-preview.js :47 const response = await fetch(endpoint, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/known-user-autocomplete.js :108 const response = await fetch(url, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/page-catalog-live.js :19 const response = await window.fetch(window.location.href, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/page-presence.js :231 .fetch(presenceEndpoint, {
  • net Gadsotek-artifactflow-38cec1b/resources/js/quick-navigation.js :33 const response = await fetch(url, {
  • net (weak) Gadsotek-artifactflow-38cec1b/scripts/smoke-mcp-remote.mjs :2 import { createServer } from 'node:http';
show 10 more
  • net (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/artifact-egress-matrix.spec.ts :5 import { createServer } from 'node:net';
  • net (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/editor.spec.ts :1907 fetch('${baseUrl}/draft-preview-network-check')
  • net (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/mermaid-security.spec.ts :52 ` click A call fetch("${baseUrl}/mermaid-canary?via=call")`,
  • net (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/pdf-artifact-flow.spec.ts :300 `<!doctype html><script>fetch('${baseUrl}/pdf-upload-js-probe')</script>`,
  • net (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/pdf-native-viewer-spike.spec.ts :2 import { createServer, type Server, type ServerResponse } from 'node:http';
  • net (weak) Gadsotek-artifactflow-38cec1b/tests/e2e/saved-artifact-preview.spec.ts :4 import { createServer } from 'node:net';
  • net Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/healthcheck.cjs :4 const http = require('node:http');
  • net Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/src/processor-protocol.cjs :4 const http = require('node:http');
  • net (weak) Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/test/processor-protocol.test.cjs :6 const http = require('node:http');
  • net (weak) Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/test/server-startup.test.cjs :6 const http = require('node:http');

secrets 3

  • secrets (weak) Gadsotek-artifactflow-38cec1b/scripts/verify-reverb-origin-handshake.mjs :3 const appKey = process.env.REVERB_APP_KEY ?? 'artifactflow-smoke-test-key';
  • secrets Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/healthcheck.cjs :13 const secret = secretFromEnvironment(process.env.XLSX_PROCESSOR_SHARED_SECRET ?? '');
  • secrets Gadsotek-artifactflow-38cec1b/xlsx-processor-spike/src/start-server.cjs :9 const secret = secretFromEnvironment(process.env.XLSX_PROCESSOR_SHARED_SECRET ?? '');

declared dependencies 40

  • laravel/mcp@^0.9
  • @codemirror/lang-html@^6.4.12
  • @codemirror/lang-markdown@^6.5.2
  • @codemirror/language@^6.12.4
  • @codemirror/state@^6.7.4
  • @lezer/highlight@^1.2.3
  • codemirror@^6.0.2
  • laravel-echo@^2.5.0
  • mermaid@12.0.0
  • pusher-js@^8.6.0
  • tabulator-tables@6.5.2
  • @eslint/js@^10.0.1
show 28 more
  • @playwright/test@^1.63.0
  • @tailwindcss/vite@^4.3.3
  • concurrently@^10.0.5
  • eslint@^10.10.0
  • eslint-config-prettier@^10.1.8
  • globals@^17.12.0
  • laravel-vite-plugin@^3.2.0
  • prettier@^3.9.6
  • tailwindcss@^4.3.2
  • vite@^8.3.0
  • bacon/bacon-qr-code@^3.0
  • laravel/framework@^13.0
  • laravel/reverb@^1.10
  • pragmarx/google2fa@^9.0
  • resend/resend-php@^1.0
  • driftingly/rector-laravel@^2.3
  • fakerphp/faker@^1.23
  • larastan/larastan@^3.1
  • laravel/pail@^1.2
  • laravel/tinker@^3.0
  • mockery/mockery@^1.6
  • nunomaduro/collision@^8.6
  • pestphp/pest@^4.4
  • pestphp/pest-plugin-laravel@^4.1
  • pestphp/pest-plugin-type-coverage@^4.0
  • phpunit/phpunit@^12.5
  • rector/rector@^2.3
  • symplify/easy-coding-standard@^13.0

obfuscation 1

  • dynamic require()/import() Gadsotek-artifactflow-38cec1b/tests/e2e/editor.spec.ts :1369 import('${pageCatalogLiveAsset}').then(() => {