github TypeScript analyzed 81f28ca

JSONbored/loopover

The loop never sleeps — you finally can. Agents automate the entire development lifecycle (write, review, merge, learn) end to end, with a published safety record. Self-host today; rentable hosted loops in development. Any GitHub repo; Gittensor-native intelligence built in.

maintainer: JSONbored
license: AGPL-3.0
first seen: 2026-07-27
last seen: 2026-08-02
releases · 30d: 178
short id

risk 57/100 · heuristic grade

C elevated

capability exposure inferred + 35
recent drift inferred + 20
tool safety inferred + 5
trust mitigators mixed − 3

inferred mixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

graded 8m ago · see ecosystem CVEs →

risk trajectory 1 movements

2d ago C · 49 → C · 57

capability exposure grade factor +35

Inferred surface — each links to servers holding it:

vulnerabilities 0 CVEs

No known CVEs for this server.

tool safety 1 findings · grade factor +5

medium dangerous code

dynamic exec: eval()

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 81f28ca · analyzer v28 · 2d ago

skills & prompt files 3

danger signals63

dynamic code execution eval() JSONbored-loopover-81f28ca/src/review/auto-apply.ts :385 /** This project's freshly-computed merge precision from THIS tick's gate eval (the same field
dynamic code execution eval() JSONbored-loopover-81f28ca/src/review/stats.ts :236 /** Ranked tuning recommendations derived from the eval (ready-to-flip / tighten / loosen). */
dynamic code execution eval() JSONbored-loopover-81f28ca/test/unit/selfhost-redis-cache.test.ts :41 async eval(script: string, _numkeys: number, k: string, expected: string, ttl?: string) {
dynamic code execution eval() JSONbored-loopover-81f28ca/test/unit/selfhost-redis-ratelimit.test.ts :20 async eval(_script: string, _numKeys: number, key: string, windowMs: string) {
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/packages/discovery-index/scripts/validate-posthog-release.ts :10 const DEFAULT_POSTHOG_APP_HOST = "https://us.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/packages/discovery-index/src/posthog.ts :27 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/packages/loopover-mcp/lib/telemetry.ts :30 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/packages/loopover-miner/lib/posthog.ts :25 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/review-enrichment/scripts/validate-posthog-release.ts :9 const DEFAULT_POSTHOG_APP_HOST = "https://us.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/review-enrichment/src/posthog.ts :27 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/review-enrichment/test/posthog-degradation.test.ts :287 const activated = await initReesPostHog({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" } as NodeJS.ProcessEnv);
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/review-enrichment/test/posthog-release-validation.test.ts :37 baseUrl: "https://us.posthog.com",
suspicious endpoint eu.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/review-enrichment/test/posthog-release-validation.test.ts :43 const config = loadPostHogReleaseValidationConfig({ POSTHOG_CLI_HOST: "https://eu.posthog.com/" });
suspicious endpoint discord.com JSONbored-loopover-81f28ca/review-enrichment/test/secret-scan.test.ts :1408 ["discord_webhook_url", "https://discord.com/api/webhooks/123456789012345678/" + b62(69) + "-"],
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/src/api/worker-posthog.ts :27 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/src/mcp/dispatch-telemetry-sink.ts :23 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/src/mcp/telemetry.ts :21 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/src/selfhost/otel.ts :36 const DEFAULT_POSTHOG_OTEL_HOST = "https://us.i.posthog.com";
suspicious endpoint posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/src/selfhost/otel.ts :48 /** PostHog's distributed-tracing product (beta: https://posthog.com/docs/distributed-tracing) is a plain
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/src/selfhost/posthog.ts :69 const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/alerts.test.ts :205 const WEBHOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-81f28ca/test/unit/content-lane-safe-url.test.ts :22 expect(isSafeHttpUrl("https://169.254.169.254")).toBe(false); // cloud metadata
suspicious endpoint 100.63.255.255 JSONbored-loopover-81f28ca/test/unit/content-lane-safe-url.test.ts :34 expect(isSafeHttpUrl("https://100.63.255.255")).toBe(true); // one below the range
suspicious endpoint 100.128.0.0 JSONbored-loopover-81f28ca/test/unit/content-lane-safe-url.test.ts :35 expect(isSafeHttpUrl("https://100.128.0.0")).toBe(true); // one above the range
suspicious endpoint 8.8.8.8 JSONbored-loopover-81f28ca/test/unit/content-lane-safe-url.test.ts :106 expect(isSafeHttpUrl("https://8.8.8.8")).toBe(true);
suspicious endpoint 1.1.1.1 JSONbored-loopover-81f28ca/test/unit/content-lane-safe-url.test.ts :107 expect(isSafeHttpUrl("https://1.1.1.1")).toBe(true);
suspicious endpoint 172.15.0.1 JSONbored-loopover-81f28ca/test/unit/content-lane-safe-url.test.ts :109 expect(isSafeHttpUrl("https://172.15.0.1")).toBe(true);
suspicious endpoint 172.32.0.1 JSONbored-loopover-81f28ca/test/unit/content-lane-safe-url.test.ts :110 expect(isSafeHttpUrl("https://172.32.0.1")).toBe(true);
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/discovery-index/posthog.test.ts :118 expect(capturedOptions?.host).toBe("https://us.i.posthog.com");
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/discovery-index/posthog.test.ts :141 await initFresh({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" } as unknown as NodeJS.ProcessEnv);
suspicious endpoint us.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/discovery-index/validate-posthog-release.test.ts :22 expect(config).toEqual({ apiKey: "phx_test", projectId: "42", release: "loopover-discovery-index@abc", baseUrl: "https://us.posthog.com" });
suspicious endpoint eu.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/discovery-index/validate-posthog-release.test.ts :26 const config = loadPostHogReleaseValidationConfig({ POSTHOG_CLI_HOST: "https://eu.posthog.com/" });
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/loop-escalation-wire.test.ts :29 expect(isValidDiscordWebhook("http://discord.com/api/webhooks/123/abc")).toBe(false); // not https
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/maintainer-recap-wire.test.ts :12 const HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/maintainer-recap.test.ts :20 const DISCORD_HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/mcp-local-telemetry.test.ts :104 host: "https://us.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/mcp-local-telemetry.test.ts :168 vi.stubEnv("LOOPOVER_MCP_POSTHOG_HOST", "https://eu.i.posthog.com");
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/mcp-telemetry.test.ts :62 host: "https://us.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/mcp-telemetry.test.ts :91 { POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" },
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-81f28ca/test/unit/miner-cli.test.ts :135 LOOPOVER_NPM_REGISTRY_URL: "http://169.254.169.254/",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/miner-egress-allowlist.test.ts :103 LOOPOVER_MINER_POSTHOG_HOST: "https://eu.i.posthog.com",
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/miner-posthog.test.ts :75 host: "https://us.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/miner-posthog.test.ts :82 await initMinerPostHog({ LOOPOVER_MINER_POSTHOG_API_KEY: "phc_test_key", LOOPOVER_MINER_POSTHOG_HOST: "https://eu.i.posthog.com" });
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/notify-discord.test.ts :6 const HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/outcomes-wire.test.ts :181 const env = Object.assign(createTestEnv(), { DISCORD_REPO_WEBHOOKS: JSON.stringify({ "owner/repo": "https://discord.com/api/webhooks/repo/token" }) }) as Env;
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/queue-5.test.ts :6323 DISCORD_WEBHOOK_URL: "https://discord.com/api/webhooks/123/abc",
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/queue.test.ts :509 const env = Object.assign(createTestEnv(), { LOOPOVER_DISCORD_WEBHOOK: "https://discord.com/api/webhooks/123/abc" }) as Env;
suspicious endpoint discord.com JSONbored-loopover-81f28ca/test/unit/review-recap.test.ts :228 const HOOK = "https://discord.com/api/webhooks/123/abc";
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-81f28ca/test/unit/safe-url-engine.test.ts :23 expect(isSafeHttpUrl("https://169.254.169.254")).toBe(false); // cloud metadata
suspicious endpoint 100.63.255.255 JSONbored-loopover-81f28ca/test/unit/safe-url-engine.test.ts :35 expect(isSafeHttpUrl("https://100.63.255.255")).toBe(true); // one below the range
suspicious endpoint 100.128.0.0 JSONbored-loopover-81f28ca/test/unit/safe-url-engine.test.ts :36 expect(isSafeHttpUrl("https://100.128.0.0")).toBe(true); // one above the range
suspicious endpoint 8.8.8.8 JSONbored-loopover-81f28ca/test/unit/safe-url-engine.test.ts :107 expect(isSafeHttpUrl("https://8.8.8.8")).toBe(true);
suspicious endpoint 1.1.1.1 JSONbored-loopover-81f28ca/test/unit/safe-url-engine.test.ts :108 expect(isSafeHttpUrl("https://1.1.1.1")).toBe(true);
suspicious endpoint 172.15.0.1 JSONbored-loopover-81f28ca/test/unit/safe-url-engine.test.ts :110 expect(isSafeHttpUrl("https://172.15.0.1")).toBe(true);
suspicious endpoint 172.32.0.1 JSONbored-loopover-81f28ca/test/unit/safe-url-engine.test.ts :111 expect(isSafeHttpUrl("https://172.32.0.1")).toBe(true);
suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-81f28ca/test/unit/screenshot-table-vision-wiring.test.ts :148 prBody: tableBody("https://169.254.169.254/before.png", AFTER_URL),
suspicious endpoint 8.8.8.8 JSONbored-loopover-81f28ca/test/unit/selfhost-health.test.ts :297 const fine = ["https://8.8.8.8", "http://172.15.0.5", "http://172.32.0.5", "https://reviews.example.com"];
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/selfhost-otel.test.ts :384 "https://us.i.posthog.com/i/v1/traces",
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/selfhost-otel.test.ts :387 resolveOtelTraceEndpoint(env({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com/", ...postHogFallbackFlag })),
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/selfhost-posthog.test.ts :67 expect(mocks.PostHog).toHaveBeenCalledWith("phc_test_key", expect.objectContaining({ host: "https://us.i.posthog.com" }));
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/selfhost-posthog.test.ts :71 await initPostHog({ POSTHOG_API_KEY: "phc_test_key", POSTHOG_HOST: "https://eu.i.posthog.com" } as unknown as NodeJS.ProcessEnv);
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/worker-posthog.test.ts :96 expect(mocks.getLastOptions()).toMatchObject({ host: "https://us.i.posthog.com", flushAt: 1, flushInterval: 0 });
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose JSONbored-loopover-81f28ca/test/unit/worker-posthog.test.ts :101 { WORKER_POSTHOG_API_KEY: "phc_test", WORKER_POSTHOG_HOST: "https://eu.i.posthog.com" } as WorkerPostHogEnv,

other grade factors evidence elsewhere

recent drift +20 capability drift →

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:JSONbored/loopover/badge.svg)](https://mcpobservatory.com/servers/github:JSONbored/loopover/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of JSONbored.

JSONbored/loopover

skills & prompt files 3

danger signals63

Navigate

Stream

Features

Display