github TypeScript analyzed f7bc9c2 deep scan · partial (241/1,714 files)
MongLong0214/commitlore
Git-native decision memory for Claude Code, Codex, Cursor and other coding agents. Preserve constraints and rejected alternatives; surface only the decisions still in force.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http
verified
reported
listed in the official MCP registry counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit f7bc9c2 · analyzer v33 · 16h ago
skills & prompt files 8
- agent-rules MongLong0214-commitlore-f7bc9c2/AGENTS.md
- skill MongLong0214-commitlore-f7bc9c2/hermes/skills/commitlore/commits/SKILL.md
- skill MongLong0214-commitlore-f7bc9c2/hermes/skills/commitlore/query/SKILL.md
- skill MongLong0214-commitlore-f7bc9c2/hermes/skills/commitlore/setup/SKILL.md
- skill MongLong0214-commitlore-f7bc9c2/skills/commitlore-codex/SKILL.md
- skill MongLong0214-commitlore-f7bc9c2/skills/commitlore-commits/SKILL.md
- skill MongLong0214-commitlore-f7bc9c2/skills/commitlore-query/SKILL.md
- skill MongLong0214-commitlore-f7bc9c2/skills/commitlore-setup/SKILL.md
danger signals19
- dynamic code execution new Function() MongLong0214-commitlore-f7bc9c2/dist/commitlore.mjs :2946
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - committed secret AWS access key id MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/negative/08-commit-verbose-diff.txt :19
AKIA7C…(20 chars, redacted) - committed secret AWS access key id MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/01-aws-access-key-id.expected.json :8
AKIA7C…(20 chars, redacted) - committed secret AWS access key id MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/01-aws-access-key-id.txt :4
AKIA7C…(20 chars, redacted) - committed secret GitHub token MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/03-github-token.expected.json :8
ghp_wo…(40 chars, redacted) - committed secret GitHub token MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/03-github-token.txt :3
ghp_wo…(40 chars, redacted) - committed secret GitHub fine-grained PAT MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/04-github-fine-grained-pat.expected.json :8
github…(93 chars, redacted) - committed secret GitHub fine-grained PAT MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/04-github-fine-grained-pat.txt :3
github…(93 chars, redacted) - committed secret OpenAI key MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/05-openai-api-key.expected.json :8
sk-Bkk…(51 chars, redacted) - committed secret OpenAI key MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/05-openai-api-key.txt :3
sk-Bkk…(51 chars, redacted) - committed secret Anthropic key MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/06-anthropic-api-key.expected.json :8
sk-ant…(108 chars, redacted) - committed secret Anthropic key MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/06-anthropic-api-key.txt :3
sk-ant…(108 chars, redacted) - committed secret Slack token MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/08-slack-token.expected.json :8
xoxb-Q…(53 chars, redacted) - committed secret Slack token MongLong0214-commitlore-f7bc9c2/spec/fixtures/secrets/positive/08-slack-token.txt :3
xoxb-Q…(53 chars, redacted) - committed secret GitHub token MongLong0214-commitlore-f7bc9c2/test/capture-shadow.test.ts :105
ghp_a1…(40 chars, redacted) - committed secret AWS access key id MongLong0214-commitlore-f7bc9c2/test/reader-redacts-secrets.test.ts :62
AKIA29…(20 chars, redacted) - committed secret GitHub token MongLong0214-commitlore-f7bc9c2/test/reader-redacts-secrets.test.ts :63
ghp_u8…(40 chars, redacted) - committed secret AWS access key id MongLong0214-commitlore-f7bc9c2/test/secret-guard.test.ts :206
AKIA7C…(20 chars, redacted) - committed secret GitHub token MongLong0214-commitlore-f7bc9c2/test/secret-guard.test.ts :265
ghp_wo…(40 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 598
filesystem 307
- fs MongLong0214-commitlore-f7bc9c2/action/lint/lint.mjs :26
import { appendFileSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/action/preserve/preserve.mjs :36
import { appendFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic.ts :1
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/capture.ts :1
import { readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/hooks.ts :1
import { mkdirSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/ledger.ts :19
import { readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/noise.ts :1
import { mkdtempSync, rmSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/quality.ts :1
import { readdirSync, readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/report.ts :1
import { writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/scale.ts :1
import { mkdirSync, statSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/survival.ts :1
import { mkdirSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/drivers/claude-headless.ts :2
import { mkdtempSync, writeFileSync } from "node:fs";
show 28 more
- fs MongLong0214-commitlore-f7bc9c2/bench/drivers/dry-run.ts :1
import fs from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/external/corpus.ts :11
import { existsSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/external/report.ts :13
import { writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/external/run.ts :23
import { mkdirSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/hooks-settings.ts :18
import { existsSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/m5-analysis.ts :23
import { existsSync, readFileSync, statSync } from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/m6-pilot-analysis.ts :13
import { readFileSync } from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/metrics.ts :1
import fs from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/report.ts :30
import fs from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/retrieval/compare.ts :2
import { readFileSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/bench/runner.ts :3
import fs from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/task-loader.ts :1
import fs from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/verify.mjs :90
import fs from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/bench/workspace.ts :2
import fs from "node:fs"; - fs MongLong0214-commitlore-f7bc9c2/dist/cli.js :12
import { readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/capture.js :19
import { readFileSync, writeFileSync } from 'node:fs'; - fs (weak) MongLong0214-commitlore-f7bc9c2/dist/commands/demo.js :15
import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/capture-commit-msg-hook.js :7
import { existsSync, readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/capture-hook-runtime.js :7
import { accessSync, constants as fsConstants, existsSync, rmSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-mcp-registration-runtime.js :38
import { existsSync, readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/history-squash-inheritance.js :32
import { existsSync, readFileSync, readdirSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/runtime-cli-runtime.js :7
import { existsSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/runtime-runtime-identity.js :2
import { existsSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/transport-notes-push.js :7
import { existsSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/report.js :31
import { existsSync, readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/guard.js :23
import { readFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/harvest-verify.js :18
import { readFileSync, writeFileSync } from 'node:fs'; - fs MongLong0214-commitlore-f7bc9c2/dist/commands/harvest.js :21
import { readFileSync, writeFileSync } from 'node:fs';
267 more not shown — this panel samples each group; the count above is the real total.
shell / exec 187
- shell MongLong0214-commitlore-f7bc9c2/action/lint/lint.mjs :25
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/action/preserve/preserve.mjs :35
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/bench/deterministic.ts :2
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/bench/deterministic/shared.ts :1
import { execFileSync, spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/bench/drivers/claude-headless.ts :1
import { spawn, spawnSync } from "node:child_process"; - shell MongLong0214-commitlore-f7bc9c2/bench/git.ts :1
import { spawnSync } from "node:child_process"; - shell MongLong0214-commitlore-f7bc9c2/bench/repository-instant.ts :13
import { execFileSync } from "node:child_process"; - shell MongLong0214-commitlore-f7bc9c2/bench/runner.ts :2
import { execFileSync } from "node:child_process"; - shell (weak) MongLong0214-commitlore-f7bc9c2/dist/commands/demo.js :14
import { execFileSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/capture-hook-runtime.js :104
const preserved = spawn('/bin/sh', ['-c', '"$0" "$1"', chained, probe], { - shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-inject-runtime.js :210
const run = spawn(executable, args, { - shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-inject-version.js :57
const run = spawn(executable, ['--version'], {
show 28 more
- shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-mcp-registration-runtime.js :37
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/history-squash-inheritance.js :31
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/model.js :1
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/hermes.js :7
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/init.js :44
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/installer-hosts.js :12
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/uninstall.js :19
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commands/update.js :27
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/commitlore.mjs :8180
import childProcess from "node:child_process"; - shell MongLong0214-commitlore-f7bc9c2/dist/core/backfill.js :50
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/core/codex-plugin.js :6
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/core/git.js :10
import { spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/core/latest-release.js :26
import { spawn, spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/core/mcp-probe.js :10
import { spawn, spawnSync } from 'node:child_process'; - shell MongLong0214-commitlore-f7bc9c2/dist/core/trusted-authors.js :33
import { spawnSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/adoption-range.mjs :18
import { execFileSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-readme-numbers.mjs :26
import { spawnSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-release-target.mjs :26
import { spawnSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-release-version.mjs :39
import { execFileSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-tag-binding.mjs :33
import { spawnSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/make-synthetic-repo.mjs :25
import { spawn } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/measure-scale.mjs :27
import { execFileSync, spawn, spawnSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/measure.mjs :37
import { execFileSync, spawnSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/negative-control.mjs :33
import { execFileSync, spawnSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/verify-canonical-artifact.mjs :2
import { execFileSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/verify-canonical-handoff.mjs :34
import { execFileSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/spec/schema/compare-trailers.mjs :11
import { execFileSync } from 'node:child_process'; - shell (weak) MongLong0214-commitlore-f7bc9c2/spec/schema/roundtrip.mjs :14
import { execFileSync } from 'node:child_process';
147 more not shown — this panel samples each group; the count above is the real total.
network 13
- net MongLong0214-commitlore-f7bc9c2/bench/retrieval/compare.ts :375
const response = await fetch(`${OLLAMA_URL}${path}`, { - net MongLong0214-commitlore-f7bc9c2/dist/commitlore.mjs :14543
const found = prs.fetch(target.sha); - net MongLong0214-commitlore-f7bc9c2/dist/core/backfill.js :454
const found = prs.fetch(target.sha); - net MongLong0214-commitlore-f7bc9c2/dist/core/query.js :189
return fallback.fetch(query); - net (weak) MongLong0214-commitlore-f7bc9c2/scripts/app-installation-token.mjs :52
const response = await fetch(`https://api.github.com${path}`, { - net (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-exact-head-ci.mjs :175
const response = await fetch(`${apiBase}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}${path}`, { - net MongLong0214-commitlore-f7bc9c2/src/core/backfill.ts :694
const found = prs.fetch(target.sha); - net MongLong0214-commitlore-f7bc9c2/src/core/query.ts :462
if (fallback !== null) return fallback.fetch(query); - net (weak) MongLong0214-commitlore-f7bc9c2/test/action-lint.test.ts :529
const CLIENTS = ['fetch(', 'axios', 'node-fetch', 'XMLHttpRequest', 'node:https', 'node:http']; - net (weak) MongLong0214-commitlore-f7bc9c2/test/action-preserve.test.ts :713
const CLIENTS = ['fetch(', 'axios', 'node-fetch', 'XMLHttpRequest', 'node:https', 'node:http']; - net (weak) MongLong0214-commitlore-f7bc9c2/test/doctor-invariants.test.ts :58
import net from 'node:net'; - net (weak) MongLong0214-commitlore-f7bc9c2/test/pre-push-hook.test.ts :19
import { createServer } from 'node:http';
show 1 more
- net (weak) MongLong0214-commitlore-f7bc9c2/test/token-ledger.test.ts :190
writeFileSync(join(dir, 'leaf.js'), "import https from 'node:https';\nexport const get = () => https;\n");
secrets 3
- secrets MongLong0214-commitlore-f7bc9c2/action/preserve/preserve.mjs :91
const TOKEN = (process.env.COMMITLORE_TOKEN ?? '').trim(); - secrets (weak) MongLong0214-commitlore-f7bc9c2/scripts/app-installation-token.mjs :72
const privateKey = process.env.COMMITLORE_BOT_KEY ?? ''; - secrets (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-exact-head-ci.mjs :171
const token = process.env.GITHUB_TOKEN;
database 2
- db (weak) MongLong0214-commitlore-f7bc9c2/test/bench-rejected-path.test.ts :75
'+import Redis from "ioredis";', - db (weak) MongLong0214-commitlore-f7bc9c2/test/capture-verify.test.ts :1086
const diff = 'diff --git a/db.ts b/db.ts\n--- a/db.ts\n+++ b/db.ts\n@@ -1 +1 @@\n-import sqlite from "sqlite3"\n+import pg from "pg"\n';
declared dependencies 10
- @modelcontextprotocol/sdk@^1.30.0
- ajv@^8.20.0
- ajv-formats@^3.0.1
- commander@^15.0.0
- @types/js-yaml@^4.0.9
- @types/node@^22.10.0
- esbuild@^0.28.2
- js-yaml@^5.4.1
- typescript@^5.7.0
- vitest@^4.1.11
obfuscation 1
- dynamic require()/import() MongLong0214-commitlore-f7bc9c2/scripts/measure-scale.mjs :143
const { openIndex, closeIndex, updateIndex } = await import(${JSON.stringify(join(PACKAGE_ROOT, 'dist', 'core', 'index-db.js'))});