github TypeScript analyzed 021806b

MobsLInep/mcpgen

Turn any API (OpenAPI / GraphQL / code) into a verified, deployable Model Context Protocol (MCP) server.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 021806b · analyzer v33 · 2d ago

code evidence vv0.1.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 122

fs (weak) MobsLInep-mcpgen-021806b/packages/cli/src/cli.e2e.test.ts :7 import { existsSync, mkdtempSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/cli/src/generate.test.ts :1 import { existsSync, mkdtempSync } from "node:fs";
fs MobsLInep-mcpgen-021806b/packages/cli/src/generate.ts :16 import { writeFileSync } from "node:fs";
fs MobsLInep-mcpgen-021806b/packages/cli/src/init.ts :6 import { existsSync } from "node:fs";
fs MobsLInep-mcpgen-021806b/packages/core/src/detect.ts :9 import { readFile, stat } from "node:fs/promises";
fs (weak) MobsLInep-mcpgen-021806b/packages/core/src/generate/cache.test.ts :4 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/core/src/generate/engine.test.ts :1 import { mkdtempSync, readFileSync } from "node:fs";
fs MobsLInep-mcpgen-021806b/packages/core/src/generate/engine.ts :10 import { mkdirSync, writeFileSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/core/src/generate/golden.test.ts :18 import { readdirSync, readFileSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/core/src/parsers/graphql.test.ts :1 import { readFileSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/core/src/verify/docker-smoke.test.ts :14 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/core/src/verify/toolchain.test.ts :8 import { existsSync, mkdtempSync, rmSync } from "node:fs";

show 6 more

fs MobsLInep-mcpgen-021806b/packages/core/src/verify/toolchain.ts :16 import { openSync, readFileSync, writeFileSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/core/src/verify/verify.test.ts :11 import { readFileSync, readdirSync } from "node:fs";
fs MobsLInep-mcpgen-021806b/packages/core/src/verify/verify.ts :21 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/packages/templates/src/index.test.ts :1 import { existsSync } from "node:fs";
fs MobsLInep-mcpgen-021806b/packages/templates/src/index.ts :13 import { readFileSync } from "node:fs";
fs (weak) MobsLInep-mcpgen-021806b/scripts/security-lint.mjs :17 import { readdirSync, readFileSync, statSync } from "node:fs";

shell (weak) MobsLInep-mcpgen-021806b/packages/cli/src/cli.e2e.test.ts :6 import { execFileSync, spawnSync } from "node:child_process";
shell MobsLInep-mcpgen-021806b/packages/core/src/doctor.ts :9 import { execFile } from "node:child_process";
shell (weak) MobsLInep-mcpgen-021806b/packages/core/src/security/audit.test.ts :82 import { execSync } from "node:child_process";
shell MobsLInep-mcpgen-021806b/packages/core/src/security/audit.ts :230 // child_process.exec / execSync run a *shell string* (injection-prone);
shell (weak) MobsLInep-mcpgen-021806b/packages/core/src/verify/docker-smoke.test.ts :13 import { execFileSync, spawnSync } from "node:child_process";
shell MobsLInep-mcpgen-021806b/packages/core/src/verify/toolchain.ts :15 import { spawn } from "node:child_process";

net MobsLInep-mcpgen-021806b/apps/api/src/http.ts :6 import type { IncomingMessage, ServerResponse } from "node:http";
net MobsLInep-mcpgen-021806b/apps/api/src/parse.ts :44 res = await fetch(url, {
net (weak) MobsLInep-mcpgen-021806b/apps/api/src/server.test.ts :2 import type { AddressInfo } from "node:net";
net MobsLInep-mcpgen-021806b/apps/api/src/server.ts :16 import { createServer, type Server } from "node:http";
net MobsLInep-mcpgen-021806b/apps/web/lib/api.ts :33 const res = await fetch(`${API_BASE}/api/parse`, {
net (weak) MobsLInep-mcpgen-021806b/packages/core/src/security/audit.test.ts :131 return fetch("https://api.example.com/" + args.id);
net MobsLInep-mcpgen-021806b/packages/core/src/security/audit.ts :250 * Rule 4 — no raw upstream calls. `fetch(` must live only in `src/http.ts`, the
net (weak) MobsLInep-mcpgen-021806b/packages/core/src/verify/docker-smoke.test.ts :83 const res = await fetch(`http://localhost:${hostPort}/healthz`);
net (weak) MobsLInep-mcpgen-021806b/packages/core/src/verify/mock.test.ts :18 const list = await fetch(`${upstream.url}/pets`);
net MobsLInep-mcpgen-021806b/packages/core/src/verify/mock.ts :11 import { createServer } from "node:http";

secrets MobsLInep-mcpgen-021806b/apps/api/src/runner.ts :33 process.env.MCPGEN_ANTHROPIC_API_KEY ?? process.env.ANTHROPIC_API_KEY;
secrets MobsLInep-mcpgen-021806b/packages/cli/src/generate.ts :59 process.env.MCPGEN_ANTHROPIC_API_KEY ?? process.env.ANTHROPIC_API_KEY;
secrets (weak) MobsLInep-mcpgen-021806b/packages/core/src/generate/adversarial.test.ts :73 const TEMPLATE_INJECT = "${process.env.SECRET}`; evil(); `";
secrets (weak) MobsLInep-mcpgen-021806b/packages/core/src/security/audit.test.ts :67 const token = process.env.MCPGEN_BEARER_TOKEN;
secrets MobsLInep-mcpgen-021806b/packages/core/src/security/audit.ts :128 // process.env.X_TOKEN / .X_SECRET / .X_KEY interpolated into a log.

prepublishOnly MobsLInep-mcpgen-021806b/packages/cli/package.json :44 tsc -p tsconfig.json