github TypeScript re-analysis due

Mujadarah/TokenGraph

github

Local-first Codex and Claude Code MCP plugin for compact code, SQL, memory, and log context routing.

maintainer: Mujadarah
license: Apache-2.0
first seen: 2026-07-05
last seen: 2026-08-04
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 42 tools

transport stdio counts 42 tools · 0 res · 0 prompts permission surface via code analysis

tools

tokengraph_add_rule
tokengraph_analyze
tokengraph_assess_change_risk
tokengraph_check_architecture
tokengraph_compress
tokengraph_compress_context
tokengraph_compress_output
tokengraph_confirm_memory
tokengraph_delete_memory
tokengraph_delete_rule
tokengraph_deprecate_memory
tokengraph_explain_symbol
tokengraph_export_project_map
tokengraph_find_memory_conflicts
tokengraph_generate_wiki
tokengraph_get_config
tokengraph_index_project
tokengraph_index_status
tokengraph_link_memory
tokengraph_list_rules
tokengraph_plan_context
tokengraph_prepare_context
tokengraph_project_map
tokengraph_propose_knowledge
tokengraph_query_context
tokengraph_recall
tokengraph_recall_memory
tokengraph_remember_decision
tokengraph_reset_project
tokengraph_review_memories
tokengraph_search_graph
tokengraph_set_profile
tokengraph_setup
tokengraph_setup_status
tokengraph_show_token_savings
tokengraph_show_wiki_page
tokengraph_summarize_sql
tokengraph_task_report
tokengraph_trace_failure
tokengraph_update_config
tokengraph_update_memory
tokengraph_update_rule

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit af29092 · analyzer v33 · 1w ago

skills & prompt files 20

danger signals2

dynamic code execution new Function() Mujadarah-TokenGraph-af29092/release/tokengraph/dist/index.js :8615 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());
dynamic code execution eval() Mujadarah-TokenGraph-af29092/release/tokengraph/dist/polyglot-worker.js :2331 ASM_CONSTS[start] = eval(func);

code evidence vv0.23.1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 109

filesystem 55

fs (weak) Mujadarah-TokenGraph-af29092/docs/benchmarks/host-evaluations/verifiers/2026-07-22-nextbase-validation-fallback.mjs :3 import { readFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/docs/benchmarks/host-evaluations/verifiers/2026-07-22-ts-reset-map-constructor.mjs :3 import { readFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/benchmark-lib.ts :1 import { readFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/benchmark.mjs :2 import { mkdtemp, rm } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/build.mjs :3 import { chmod, readFile, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/package-plugin.mjs :2 import { access, chmod, cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/paired-host-acceptance.mjs :3 import { access } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/smoke.mjs :3 import { access, realpath } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/validate-plugin.mjs :2 import { access, readFile, readdir } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/validate-release-notes.mjs :2 import { readFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/validate-release-version.mjs :2 import { readFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/architectureRules.ts :2 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/artifact.ts :1 import { readFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/config.ts :1 import { copyFile, readFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/fileScanner.ts :2 import { readdir, readFile, stat } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/hostWorkspace.ts :2 import { readFile, realpath, rm } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/knowledgeReviewQueue.ts :2 import { readFile, realpath } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/memoryStore.ts :2 import { readFile, rename } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/pairedEval.ts :2 import { readFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/pairedHost.ts :3 import { access, chmod, mkdir, open, readFile, rm, symlink, writeFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/persistence.ts :1 import { readFile, rm } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/polyglot.ts :2 import { access, readFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/projectIndexer.ts :2 import { access, readFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/repositoryIdentity.ts :4 import { access, lstat, readFile, readdir } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/retrieval.ts :2 import { open } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/routingControl.ts :1 import { readFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/runner.ts :3 import { readFile, readdir, rm } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/storage.ts :2 import { chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/storagePolicy.ts :1 import { chmod, lstat, mkdir, readFile, readdir, realpath, rm } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/taskLedger.ts :2 import { readFile, readdir, rename, rm } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/typescriptParser.ts :1 import { access } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/hooks.ts :3 import { mkdir, open, readFile, readdir, rm, stat } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :4 import { access, realpath } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/audit-remediation.test.ts :2 import { mkdtemp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/benchmark.test.ts :1 import { access, cp, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/cli-runner.test.ts :3 import { access, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/cli-smoke.test.ts :2 import { access, copyFile, cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/core.test.ts :2 import { access, cp, mkdtemp, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/foundations.test.ts :2 import { access, mkdir, mkdtemp, rm, symlink, utimes, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/hooks.test.ts :3 import { mkdir, mkdtemp, readFile, readdir, realpath, rm, utimes, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/indexing-foundations.test.ts :6 import { mkdtemp, writeFile, rm } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/knowledge-review-queue.test.ts :1 import { mkdir, mkdtemp, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/mcp-smoke.test.ts :3 import { access, mkdir, mkdtemp, readFile, readdir, realpath, rm, utimes, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/paired-eval.test.ts :1 import { access, readFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/paired-host.test.ts :3 import { mkdir, mkdtemp, readdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/release-workflow.test.ts :2 import { readFileSync } from "node:fs";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/retrieval.test.ts :1 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/runner.test.ts :1 import { readFile, mkdtemp, rm } from "node:fs/promises";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/skill-contract.test.ts :1 import { readFileSync, readdirSync } from "node:fs";
fs (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/task-ledger.test.ts :1 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/release/tokengraph/dist/cli.js :6 import { readFile as readFile4, readdir as readdir3, rm as rm3 } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/release/tokengraph/dist/hooks.js :5 import { mkdir as mkdir2, open as open2, readFile as readFile5, readdir as readdir3, rm as rm4, stat as stat2 } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/release/tokengraph/dist/index.js :19437 import { access as access5, realpath as realpath5 } from "node:fs/promises";
fs Mujadarah-TokenGraph-af29092/release/tokengraph/dist/polyglot-worker.js :1538 var fs = require("fs");
fs Mujadarah-TokenGraph-af29092/release/tokengraph/dist/typescript-worker.cjs :5277 fs = require("fs");

shell / exec 20

shell (weak) Mujadarah-TokenGraph-af29092/docs/benchmarks/host-evaluations/verifiers/2026-07-22-nextbase-validation-fallback.mjs :2 import { spawn } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/docs/benchmarks/host-evaluations/verifiers/2026-07-22-ts-reset-map-constructor.mjs :2 import { spawn } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/build.mjs :2 import { spawn } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/paired-host-acceptance.mjs :2 import { spawn } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/smoke.mjs :2 import { spawn } from "node:child_process";
shell Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/pairedHost.ts :1 import { spawn } from "node:child_process";
shell Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/repositoryIdentity.ts :1 import { execFile } from "node:child_process";
shell Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/core/runner.ts :2 import { spawn } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/audit-remediation.test.ts :1 import { execFile } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/cli-runner.test.ts :1 import { execFile } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/cli-smoke.test.ts :1 import { execFile } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/core.test.ts :1 import { execFile as execFileCallback } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/foundations.test.ts :1 import { execFile as execFileCallback } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/hooks.test.ts :2 import { spawn } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/mcp-smoke.test.ts :1 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/paired-host.test.ts :1 import { execFile } from "node:child_process";
shell (weak) Mujadarah-TokenGraph-af29092/plugins/tokengraph/tests/release-workflow.test.ts :1 import { spawnSync } from "node:child_process";
shell Mujadarah-TokenGraph-af29092/release/tokengraph/dist/cli.js :5 import { spawn } from "node:child_process";
shell Mujadarah-TokenGraph-af29092/release/tokengraph/dist/hooks.js :321 import { execFile } from "node:child_process";
shell Mujadarah-TokenGraph-af29092/release/tokengraph/dist/index.js :20044 import { execFile } from "node:child_process";

network 1

net Mujadarah-TokenGraph-af29092/release/tokengraph/dist/polyglot-worker.js :1480 const response = await fetch(input2);

tool registrations 42

tokengraph_setup Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :826
tokengraph_prepare_context Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :851
tokengraph_query_context Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1045
tokengraph_compress Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1140
tokengraph_recall Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1199
tokengraph_analyze Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1242
tokengraph_propose_knowledge Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1290
tokengraph_task_report Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1335
tokengraph_setup_status Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1375
tokengraph_index_project Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1386
tokengraph_index_status Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1439
tokengraph_reset_project Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1456
tokengraph_get_config Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1478
tokengraph_set_profile Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1491
tokengraph_update_config Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1505
tokengraph_list_rules Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1543
tokengraph_add_rule Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1559
tokengraph_update_rule Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1577
tokengraph_delete_rule Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1611
tokengraph_check_architecture Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1632
tokengraph_trace_failure Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1651
tokengraph_assess_change_risk Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1673
tokengraph_project_map Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1696
tokengraph_generate_wiki Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1714
tokengraph_show_wiki_page Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1743
tokengraph_plan_context Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1775
tokengraph_search_graph Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1817
tokengraph_explain_symbol Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1835
tokengraph_summarize_sql Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1849
tokengraph_compress_output Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1863
tokengraph_compress_context Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1878
tokengraph_remember_decision Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1915
tokengraph_update_memory Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1962
tokengraph_delete_memory Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :1996
tokengraph_deprecate_memory Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2018
tokengraph_confirm_memory Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2041
tokengraph_find_memory_conflicts Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2064
tokengraph_link_memory Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2096
tokengraph_recall_memory Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2123
tokengraph_review_memories Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2143
tokengraph_export_project_map Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2162
tokengraph_show_token_savings Mujadarah-TokenGraph-af29092/plugins/tokengraph/src/server.ts :2180

declared dependencies 10

@modelcontextprotocol/server@2.0.0-beta.2
ignore@^5.3.2
web-tree-sitter@0.26.11
zod@^4.0.0
@types/node@^22.10.0
esbuild@^0.28.1
fflate@0.8.3
typescript@5.9.3
vite@6.4.3
vitest@^3.2.6

obfuscation 1

dynamic require()/import() Mujadarah-TokenGraph-af29092/plugins/tokengraph/scripts/benchmark.mjs :22 const { runBenchmarkCli } = await import(`${pathToFileURL(output).href}?run=${Date.now()}`);