github TypeScript analyzed f665d94

JSONbored/loopover

The loop never sleeps — you finally can. Agents automate the entire development lifecycle (write, review, merge, learn) end to end, with a published safety record. Self-host today; rentable hosted loops in development. Any GitHub repo; Gittensor-native intelligence built in.

maintainer: JSONbored
licence: AGPL-3.0
first seen: 2026-07-27
last seen: 2026-09-08
releases · 30d: 0
short id

risk 58/100 · heuristic grade

C elevated inferred analyzer v33 (current)

vulnerabilities attested + 14
capability exposure inferred + 35
tool safety inferred + 12
trust mitigators mixed − 3

attested inferred mixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

grade last moved 2d ago · see ecosystem CVEs →

risk trajectory 4 movements

2d ago C · 44 → C · 58
4w ago C · 37 → C · 44
5w ago C · 57 → C · 37
6w ago C · 49 → C · 57

capability exposure grade factor +35

Inferred surface — each links to servers holding it:

vulnerabilities 2 CVEs · grade factor +14

MEDIUM

Rate limit bypass via unvalidated bearer token rotation affects ["<= 0.1.0"]

MEDIUM

Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial da… affects ["<= 0.1.0"]

tool safety 3 findings · grade factor +12

high dangerous code

committed secret: private key, GitHub token, GitHub fine-grained PAT, Anthropic key · dynamic exec: eval()
low dangerous code

env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke
low dangerous code

env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f665d94 · analyzer v33 · 1d ago

skills & prompt files 3

danger signals77

dynamic code execution eval() JSONbored-loopover-f665d94/test/unit/selfhost-redis-cache.test.ts :41 async eval(script: string, _numkeys: number, k: string, expected: string, ttl?: string) {
dynamic code execution eval() JSONbored-loopover-f665d94/test/unit/selfhost-redis-ratelimit.test.ts :20 async eval(_script: string, _numKeys: number, key: string, windowMs: string) {
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.test.ts :9 const API = "https://us.i.posthog.com";
suspicious endpoint us-assets.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.test.ts :10 const ASSETS = "https://us-assets.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.ts :39 const POSTHOG_API_HOST = "https://us.i.posthog.com";
suspicious endpoint us-assets.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.ts :40 const POSTHOG_ASSET_HOST = "https://us-assets.i.posthog.com";
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.test.ts :83 expect(config.ui_host).toBe("https://us.posthog.com");
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.test.ts :100 vi.stubEnv("VITE_POSTHOG_HOST", "https://us.i.posthog.com");
suspicious endpoint eu.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.test.ts :110 vi.stubEnv("VITE_POSTHOG_UI_HOST", "https://eu.posthog.com");
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.ts :81 return (import.meta.env?.VITE_POSTHOG_UI_HOST as string | undefined) || "https://us.posthog.com";
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/packages/discovery-index/scripts/validate-posthog-release.ts :10 const DEFAULT_POSTHOG_APP_HOST = "https://us.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/packages/discovery-index/src/posthog.ts :27 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/packages/loopover-mcp/lib/telemetry.ts :30 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/packages/loopover-miner/lib/posthog.ts :26 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/review-enrichment/scripts/validate-posthog-release.ts :9 const DEFAULT_POSTHOG_APP_HOST = "https://us.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/review-enrichment/src/posthog.ts :27 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/review-enrichment/test/posthog-degradation.test.ts :287 const activated = await initReesPostHog({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" } as NodeJS.ProcessEnv);
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/review-enrichment/test/posthog-release-validation.test.ts :37 baseUrl: "https://us.posthog.com",
suspicious endpoint eu.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/review-enrichment/test/posthog-release-validation.test.ts :43 const config = loadPostHogReleaseValidationConfig({ POSTHOG_CLI_HOST: "https://eu.posthog.com/" });
suspicious endpoint discord.com JSONbored-loopover-f665d94/review-enrichment/test/secret-scan.test.ts :1408 ["discord_webhook_url", "https://discord.com/api/webhooks/123456789012345678/" + b62(69) + "-"],
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/src/api/worker-posthog.ts :27 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/src/mcp/dispatch-telemetry-sink.ts :32 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/src/mcp/telemetry.ts :21 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/src/selfhost/otel.ts :36 const DEFAULT_POSTHOG_OTEL_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/src/selfhost/posthog.ts :69 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/alerts.test.ts :205 const WEBHOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/analytics-proxy.test.ts :17 const API = "https://us.i.posthog.com";
suspicious endpoint us-assets.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/analytics-proxy.test.ts :18 const ASSETS = "https://us-assets.i.posthog.com";
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :22 expect(isSafeHttpUrl("https://169.254.169.254")).toBe(false); // cloud metadata
suspicious endpoint 100.63.255.255 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :34 expect(isSafeHttpUrl("https://100.63.255.255")).toBe(true); // one below the range
suspicious endpoint 100.128.0.0 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :35 expect(isSafeHttpUrl("https://100.128.0.0")).toBe(true); // one above the range
suspicious endpoint 8.8.8.8 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :106 expect(isSafeHttpUrl("https://8.8.8.8")).toBe(true);
suspicious endpoint 1.1.1.1 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :107 expect(isSafeHttpUrl("https://1.1.1.1")).toBe(true);
suspicious endpoint 172.15.0.1 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :109 expect(isSafeHttpUrl("https://172.15.0.1")).toBe(true);
suspicious endpoint 172.32.0.1 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :110 expect(isSafeHttpUrl("https://172.32.0.1")).toBe(true);
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/discovery-index/posthog.test.ts :118 expect(capturedOptions?.host).toBe("https://us.i.posthog.com");
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/discovery-index/posthog.test.ts :141 await initFresh({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" } as unknown as NodeJS.ProcessEnv);
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/discovery-index/validate-posthog-release.test.ts :22 expect(config).toEqual({ apiKey: "phx_test", projectId: "42", release: "loopover-discovery-index@abc", baseUrl: "https://us.posthog.com" });
suspicious endpoint eu.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/discovery-index/validate-posthog-release.test.ts :26 const config = loadPostHogReleaseValidationConfig({ POSTHOG_CLI_HOST: "https://eu.posthog.com/" });
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/loop-escalation-wire.test.ts :29 expect(isValidDiscordWebhook("http://discord.com/api/webhooks/123/abc")).toBe(false); // not https
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/maintainer-recap-wire.test.ts :12 const HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/maintainer-recap.test.ts :20 const DISCORD_HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/mcp-local-telemetry.test.ts :104 host: "https://us.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/mcp-local-telemetry.test.ts :168 vi.stubEnv("LOOPOVER_MCP_POSTHOG_HOST", "https://eu.i.posthog.com");
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/mcp-telemetry.test.ts :62 host: "https://us.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/mcp-telemetry.test.ts :91 { POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" },
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-f665d94/test/unit/miner-cli.test.ts :135 LOOPOVER_NPM_REGISTRY_URL: "http://169.254.169.254/",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/miner-egress-allowlist.test.ts :103 LOOPOVER_MINER_POSTHOG_HOST: "https://eu.i.posthog.com",
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/miner-posthog.test.ts :75 host: "https://us.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/miner-posthog.test.ts :82 await initMinerPostHog({ LOOPOVER_MINER_POSTHOG_API_KEY: "phc_test_key", LOOPOVER_MINER_POSTHOG_HOST: "https://eu.i.posthog.com" });
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/notify-discord.test.ts :6 const HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/outcomes-wire.test.ts :182 const env = Object.assign(createTestEnv(), { DISCORD_REPO_WEBHOOKS: JSON.stringify({ "owner/repo": "https://discord.com/api/webhooks/repo/token" }) }) as Env;
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/queue-5.test.ts :6323 DISCORD_WEBHOOK_URL: "https://discord.com/api/webhooks/123/abc",
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/queue.test.ts :509 const env = Object.assign(createTestEnv(), { LOOPOVER_DISCORD_WEBHOOK: "https://discord.com/api/webhooks/123/abc" }) as Env;
suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/review-recap.test.ts :228 const HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-f665d94/test/unit/safe-url-engine.test.ts :23 expect(isSafeHttpUrl("https://169.254.169.254")).toBe(false); // cloud metadata
suspicious endpoint 100.63.255.255 JSONbored-loopover-f665d94/test/unit/safe-url-engine.test.ts :35 expect(isSafeHttpUrl("https://100.63.255.255")).toBe(true); // one below the range
suspicious endpoint 100.128.0.0 JSONbored-loopover-f665d94/test/unit/safe-url-engine.test.ts :36 expect(isSafeHttpUrl("https://100.128.0.0")).toBe(true); // one above the range
suspicious endpoint 8.8.8.8 JSONbored-loopover-f665d94/test/unit/safe-url-engine.test.ts :107 expect(isSafeHttpUrl("https://8.8.8.8")).toBe(true);
suspicious endpoint 1.1.1.1 JSONbored-loopover-f665d94/test/unit/safe-url-engine.test.ts :108 expect(isSafeHttpUrl("https://1.1.1.1")).toBe(true);
suspicious endpoint 172.15.0.1 JSONbored-loopover-f665d94/test/unit/safe-url-engine.test.ts :110 expect(isSafeHttpUrl("https://172.15.0.1")).toBe(true);
suspicious endpoint 172.32.0.1 JSONbored-loopover-f665d94/test/unit/safe-url-engine.test.ts :111 expect(isSafeHttpUrl("https://172.32.0.1")).toBe(true);
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-f665d94/test/unit/screenshot-table-vision-wiring.test.ts :148 prBody: tableBody("https://169.254.169.254/before.png", AFTER_URL),
suspicious endpoint 8.8.8.8 JSONbored-loopover-f665d94/test/unit/selfhost-health.test.ts :297 const fine = ["https://8.8.8.8", "http://172.15.0.5", "http://172.32.0.5", "https://reviews.example.com"];
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/selfhost-otel.test.ts :385 "https://us.i.posthog.com/i/v1/traces",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/selfhost-otel.test.ts :388 resolveOtelTraceEndpoint(env({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com/", ...postHogFallbackFlag })),
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/selfhost-posthog.test.ts :73 expect(mocks.PostHog).toHaveBeenCalledWith("phc_test_key", expect.objectContaining({ host: "https://us.i.posthog.com" }));
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/selfhost-posthog.test.ts :77 await initPostHog({ POSTHOG_API_KEY: "phc_test_key", POSTHOG_HOST: "https://eu.i.posthog.com" } as unknown as NodeJS.ProcessEnv);
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/worker-posthog.test.ts :96 expect(mocks.getLastOptions()).toMatchObject({ host: "https://us.i.posthog.com", flushAt: 1, flushInterval: 0 });
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-f665d94/test/unit/worker-posthog.test.ts :101 { WORKER_POSTHOG_API_KEY: "phc_test", WORKER_POSTHOG_HOST: "https://eu.i.posthog.com" } as WorkerPostHogEnv,
committed secret private key JSONbored-loopover-f665d94/test/fixtures/verify-attested-run/synthetic-vcek-key.pem :1 PEM private key block (redacted)
committed secret GitHub token JSONbored-loopover-f665d94/test/unit/mcp-release-candidate.test.ts :115 ghp_AA…(40 chars, redacted)
committed secret GitHub fine-grained PAT JSONbored-loopover-f665d94/test/unit/mcp-release-candidate.test.ts :191 github…(40 chars, redacted)
committed secret Anthropic key JSONbored-loopover-f665d94/test/unit/miner-status.test.ts :570 sk-ant…(36 chars, redacted)
committed secret Anthropic key JSONbored-loopover-f665d94/test/unit/provider-credentials.test.ts :13 sk-ant…(35 chars, redacted)
committed secret GitHub fine-grained PAT JSONbored-loopover-f665d94/test/unit/secrets-scan.test.ts :17 github…(47 chars, redacted)
committed secret Anthropic key JSONbored-loopover-f665d94/test/unit/selfhost-ai.test.ts :2609 sk-ant…(37 chars, redacted)

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:JSONbored/loopover/badge.svg)](https://mcpobservatory.com/servers/github:JSONbored/loopover/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of JSONbored.

JSONbored/loopover

skills & prompt files 3

danger signals77

Navigate

Stream

Features

Display