github TypeScript re-analysis due

NimbleBrainInc/nimblebrain

Self-hosted platform for MCP Apps and agent automations — tools, interactive UIs, scheduled runs, multi-agent delegation.

maintainer: NimbleBrainInc
licence: NOASSERTION
first seen: 2026-06-04
last seen: 2026-09-17
releases · 30d: 4
short id

Drift inferred · capture-to-capture

tool count over time

06-07 20:44 08-11 14:48 now

2026-06-07 11t

2026-08-11 6t

2026-09-08 5t

capabilities 5 tools

transport http counts 5 tools · 0 res · 0 prompts permission surface via README inference

tools

nb__manage_tools

Promote/release tools in the active set
nb__read_resource

Read a skill:// / ui:// resource from an installed app's MCP server
nb__search

Unified search: installed tools or the connector catalog (scope param)
nb__set_preferences

Set user preferences (name, timezone, theme)
nb__status

Platform status: overview, connectors, skills, or config (scope param)

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit d54b14b · analyzer v33 · 8h ago

skills & prompt files 2

agent-rules NimbleBrainInc-nimblebrain-d54b14b/AGENTS.md
agent-rules NimbleBrainInc-nimblebrain-d54b14b/src/platform/AGENTS.md

danger signals8

dynamic code execution new Function() NimbleBrainInc-nimblebrain-d54b14b/test/unit/core-resources/bridge.test.ts :52 const factory = new Function(
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose NimbleBrainInc-nimblebrain-d54b14b/src/telemetry/manager.ts :10 const POSTHOG_HOST = "https://us.i.posthog.com";
suspicious endpoint 169.254.169.254 (cloud metadata) NimbleBrainInc-nimblebrain-d54b14b/test/integration/workspace-oauth-provider.test.ts :281 headers: { location: "http://169.254.169.254/latest/meta-data/" },
suspicious endpoint 169.254.169.254 (cloud metadata) NimbleBrainInc-nimblebrain-d54b14b/test/unit/security-hardening.test.ts :170 validateConnectorUrl(new URL("http://169.254.169.254/latest/meta-data/")),
suspicious endpoint 169.254.169.254 (cloud metadata) NimbleBrainInc-nimblebrain-d54b14b/test/unit/ssrf-guarded-fetch.test.ts :45 location: "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
suspicious endpoint 169.254.169.254 (cloud metadata) NimbleBrainInc-nimblebrain-d54b14b/test/unit/url-validator.test.ts :32 expect(() => validateConnectorUrl(new URL("http://169.254.169.254/metadata"))).toThrow(
suspicious endpoint 169.254.169.254 (cloud metadata) NimbleBrainInc-nimblebrain-d54b14b/test/unit/workspace-oauth-provider.test.ts :725 const ssrfEndpoint = "http://169.254.169.254/latest/oauth/revoke";
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose NimbleBrainInc-nimblebrain-d54b14b/web/src/telemetry.ts :21 api_host: "https://us.i.posthog.com",

code evidence vv0.26.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1383

filesystem 255

fs NimbleBrainInc-nimblebrain-d54b14b/.environments/docs-demo/capture-screenshots.ts :12 import { writeFile, mkdir } from "node:fs/promises";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/backfill-usage-ledger.ts :46 import { mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-automation-paths.ts :28 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-code-style.ts :23 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-conversation-paths.ts :37 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-core-skill-tool-refs.ts :20 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-credential-paths.ts :48 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-cycles.ts :23 import { readdirSync, readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-file-paths.ts :30 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-no-raw-console.ts :24 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-no-sentry-in-kernel.ts :18 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-personal-workspace-id.ts :32 import { readFileSync } from "node:fs";

show 28 more

fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-platform-app-transport.ts :30 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-public-origin.ts :23 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-resource-schemes.ts :40 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-tool-namespace.ts :59 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-usage-record.ts :48 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-workspace-paths.ts :33 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-workspace-splat-nesting.ts :34 import { readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/codegen-web-platform-schemas.ts :34 import { cpSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/dev-worktree.ts :30 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/dev.ts :11 import { existsSync, readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/lib/dev-env.ts :29 import { existsSync, readFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/lib/dev-prepare.ts :16 import { existsSync, readdirSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/lib/migration-lock.ts :19 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/migrate-skill-frontmatter.ts :27 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/migrate-workspace-connectors.ts :26 import { readFileSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/adapters/structured-log-sink.ts :1 import { appendFileSync, mkdirSync, readdirSync, unlinkSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/adapters/workspace-log-sink.ts :1 import { appendFileSync, mkdirSync, readdirSync, unlinkSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/api/handlers.ts :1 import { readFileSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/api/mcp-server.ts :72 import { readFileSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/api/middleware/error-log.ts :1 import { appendFileSync, mkdirSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/cli/config.ts :1 import { existsSync, readFileSync, writeFileSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/connectors/catalog/read.ts :30 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/connectors/catalog/server-detail.ts :20 import { readFileSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/connectors/providers/composio/connection.ts :38 import { existsSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/connectors/runtime/lifecycle.ts :1 import { rmSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/conversation/event-sourced-store.ts :9 import { appendFileSync, existsSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/conversation/index-cache.ts :1 import { readdirSync } from "node:fs";
fs NimbleBrainInc-nimblebrain-d54b14b/src/conversation/jsonl-store.ts :1 import { existsSync } from "node:fs";

215 more not shown — this panel samples each group; the count above is the real total.

shell / exec 25

shell (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-codegen.ts :27 import { spawnSync } from "node:child_process";
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-test-signatures.ts :121 const result = await $`bunx tsc -p ${PROJECT} --noEmit --pretty false --listFiles`
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/codegen-web-platform-schemas.ts :33 import { execSync } from "node:child_process";
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/dev-worktree.ts :29 import { spawn } from "node:child_process";
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/dev.ts :162 const webProc = spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/lib/dev-env.ts :28 import { execFileSync } from "node:child_process";
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/lib/dev-prepare.ts :15 import { spawnSync } from "node:child_process";
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/cli.test.ts :33 const proc = spawn(
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/animated-dot-contrast.test.ts :287 // EVERY hover fill, not the first: a single exec() reads one of the two
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/conversations/get-liveness.test.ts :122 const msgs = messages(await exec("get", { id: LIVE_ID, expand: "full" }));
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/conversations/preview-cap.test.ts :98 const data = payload(await exec("list", {})) as {
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/conversations/workspace-scope.test.ts :160 expect(idsOf(await exec("list", {}, WS_A))).toEqual(["conv_a1", "conv_a2"]);

show 13 more

shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/files/source.test.ts :158 const created = await exec("create", {
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/notifications/settings.test.ts :129 const res = await exec("settings");
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/notifications/source.test.ts :130 const result = await exec("list", {}, undefined);
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/runtime-domain-clean.test.ts :64 const result = spawnSync(
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/check-automation-paths.test.ts :112 const proc = Bun.spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/check-conversation-paths.test.ts :148 const proc = Bun.spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/check-core-skill-tool-refs.test.ts :192 const proc = Bun.spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/check-credential-paths.test.ts :206 const proc = Bun.spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/check-file-paths.test.ts :140 const proc = Bun.spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/check-personal-workspace-id.test.ts :106 const proc = Bun.spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/check-tool-namespace.test.ts :164 const proc = Bun.spawn({
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/scripts/dev-env.test.ts :7 import { execFileSync } from "node:child_process";
shell (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/workspace-oauth-provider.test.ts :24 // spawnSync(), it belongs in test/integration/."

network 84

net NimbleBrainInc-nimblebrain-d54b14b/.environments/docs-demo/capture-screenshots.ts :126 const response = await fetch(`http://${CDP_HOST}/json/list`);
net (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/check-catalog-dcr.ts :222 const res = await fetch(url, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/scripts/dev.ts :78 const res = await fetch(url);
net NimbleBrainInc-nimblebrain-d54b14b/src/api/routes/well-known.ts :55 const upstream = await fetch(metadataUrl);
net NimbleBrainInc-nimblebrain-d54b14b/src/connectors/providers/smithery/client.ts :126 return fetch(url, {
net NimbleBrainInc-nimblebrain-d54b14b/src/files/locator.ts :11 * **resolve-by-id:** `(ownerId, fileId) → wsId`, so a context-free fetch (the
net NimbleBrainInc-nimblebrain-d54b14b/src/model/sync-models.ts :248 const response = await fetch(API_URL);
net NimbleBrainInc-nimblebrain-d54b14b/src/model/sync-nebius.ts :321 const res = await fetch(API_URL, { headers: { Authorization: `Bearer ${key}` } });
net NimbleBrainInc-nimblebrain-d54b14b/src/platform/files/ui/src/useFileObjectUrl.ts :40 * Pass `enabled=false` to defer the fetch (e.g. off-screen thumbnails).
net NimbleBrainInc-nimblebrain-d54b14b/src/tools/credential-transport-credential.ts :110 return fetch(input as Parameters<typeof fetch>[0], { ...init, headers });
net NimbleBrainInc-nimblebrain-d54b14b/src/tools/oauth-refresh-fetch.ts :143 const doFetch: FetchLike = options.fetchImpl ?? ((url, init) => fetch(url, init));
net NimbleBrainInc-nimblebrain-d54b14b/src/tools/remote-transport.ts :109 * same-origin hops it follows. The inner fetch (minting, OAuth-refresh) sees

show 28 more

net NimbleBrainInc-nimblebrain-d54b14b/src/tools/ssrf-guarded-fetch.ts :46 const doFetch: FetchLike = baseFetch ?? ((u, i) => fetch(u, i));
net NimbleBrainInc-nimblebrain-d54b14b/src/tools/workspace-oauth-provider.ts :197 * AbortSignal threaded into every outbound `fetch()` the provider
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/helpers/remote-mcp-fixture.ts :41 async fetch(req: Request) {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/api-integration.test.ts :89 const healthRes = await fetch(`${baseUrl}/v1/health`);
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/api.test.ts :39 const res = await fetch(`${baseUrl}/v1/chat`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/api/model-policy-http.test.ts :43 fetch(`${baseUrl}${path}`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/api/personal-workspace-invariants.test.ts :91 const res = await fetch(`${baseUrl}/v1/tools/call`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/api/request-rate-limit.test.ts :121 const res = await fetch(`${baseUrl}/v1/chat`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/appcontext-chat.test.ts :38 const res = await fetch(`${baseUrl}/v1/chat`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/body-limit-routes.test.ts :56 const res = await fetch(`${baseUrl}/v1/tools/call`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/bootstrap-composer-config.test.ts :118 const res = await fetch(`${baseUrl}/v1/bootstrap`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/bootstrap-workspace-header-leak.test.ts :127 const res = await fetch(`${baseUrl}/v1/bootstrap`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/chat-file-visibility.test.ts :66 const res = await fetch(`${baseUrl}/v1/chat/stream`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/chat-metadata.test.ts :71 const res = await fetch(`${baseUrl}/v1/chat`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/chat-stream-concurrent.test.ts :107 const res = await fetch(`${baseUrl}/v1/chat/stream`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/chat-stream-disconnect.test.ts :107 const res = await fetch(`${baseUrl}/v1/chat/stream`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/cli.test.ts :19 const res = await fetch(`http://localhost:${port}/v1/health`);
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/compaction-wiring.test.ts :104 const res = await fetch(`${baseUrl}/v1/chat`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/conversation-access.test.ts :344 const res = await fetch(`${baseUrl}/v1/chat`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/conversation-integration.test.ts :242 const chatRes = await fetch(`${baseUrl}/v1/chat`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/core-registration.test.ts :89 const res = await fetch(
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/cross-workspace-file-upload.test.ts :82 const res = await fetch(`${baseUrl}/v1/resources`, { method: "POST", body: form });
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/detached-turn-http.test.ts :69 const res = await fetch(`${baseUrl}/v1/chat/start`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/file-serve-by-id.test.ts :63 const upload = await fetch(`${baseUrl}/v1/resources`, { method: "POST", body: form });
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/files-mcp-resources.test.ts :77 const res = await fetch(`${baseUrl}/v1/chat/stream`, {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/hooks-door.test.ts :155 return app.fetch(
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/identity-connector-lazy-start.test.ts :48 async fetch(req: Request) {
net (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/identity-oauth-flow.test.ts :40 async fetch(req: Request) {

44 more not shown — this panel samples each group; the count above is the real total.

secrets 32

secrets NimbleBrainInc-nimblebrain-d54b14b/src/connectors/providers/composio/config.ts :75 const apiKey = declared?.apiKey?.trim() || (process.env.COMPOSIO_API_KEY?.trim() ?? "");
secrets NimbleBrainInc-nimblebrain-d54b14b/src/connectors/providers/smithery/config.ts :107 const apiKey = declared?.apiKey?.trim() || (process.env.SMITHERY_API_KEY?.trim() ?? "");
secrets NimbleBrainInc-nimblebrain-d54b14b/src/identity/providers/workos.ts :241 const apiKey = process.env.WORKOS_API_KEY ?? config.apiKey ?? "";
secrets NimbleBrainInc-nimblebrain-d54b14b/src/model/registry.ts :77 const nebiusApiKey = apiKey ?? process.env.NEBIUS_API_KEY;
secrets NimbleBrainInc-nimblebrain-d54b14b/src/model/sync-nebius.ts :315 const key = process.env.NEBIUS_API_KEY;
secrets NimbleBrainInc-nimblebrain-d54b14b/src/oauth/fleet-assertion.ts :42 const keyB64 = process.env.NB_MCP_AUTHORIZER_TENANT_KEY;
secrets NimbleBrainInc-nimblebrain-d54b14b/src/telemetry/manager.ts :9 const POSTHOG_API_KEY = process.env.POSTHOG_API_KEY ?? "";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/eval/helpers.ts :38 const apiKey = process.env.ANTHROPIC_API_KEY;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/eval/workspace-identity.eval.test.ts :28 const apiKey = process.env.ANTHROPIC_API_KEY;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/composio-credential-boot.test.ts :68 expect(process.env.COMPOSIO_API_KEY ?? "").toBe("");
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/identity-target-install.test.ts :258 const savedKey = process.env.COMPOSIO_API_KEY;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/oauth-callback-public.test.ts :34 const savedComposioApiKey = process.env.COMPOSIO_API_KEY;

show 20 more

secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/smithery-e2e.test.ts :50 const HAVE_CREDS = Boolean(process.env.SMITHERY_API_KEY?.trim());
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/api/mcp-auth-routes.test.ts :449 process.env.NB_OAUTH_BOUNCER_TENANT_KEY = TENANT_KEY_B64;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/composio-auth.test.ts :307 const origKey = process.env.COMPOSIO_API_KEY;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/composio-config.test.ts :102 process.env.COMPOSIO_API_KEY = "k_env";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/composio-connection-probe.test.ts :89 process.env.COMPOSIO_API_KEY = "k";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/composio-sdk.test.ts :185 process.env.COMPOSIO_API_KEY = "k_test";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/composio-transport-credential.test.ts :59 process.env.COMPOSIO_API_KEY = "k_env";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/connector-tools-composio-apikey.test.ts :236 process.env.COMPOSIO_API_KEY = "k_test";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/connector-tools-composio-install.test.ts :294 process.env.COMPOSIO_API_KEY = "k_test";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/connector-tools-smithery-install.test.ts :179 process.env.SMITHERY_API_KEY = "sk_test";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/fleet-assertion.test.ts :47 const savedKey = process.env.NB_MCP_AUTHORIZER_TENANT_KEY;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/gateway-credential.test.ts :87 process.env.MCP360_API_KEY = "sk-from-env";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/managed-connector-registry.test.ts :92 process.env.COMPOSIO_API_KEY = "k_env";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/model-registry.test.ts :95 const prev = process.env.NEBIUS_API_KEY;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/oauth-bouncer-config.test.ts :63 process.env.NB_OAUTH_BOUNCER_TENANT_KEY = VALID_KEY_B64;
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/oauth/mcp-callback-url.test.ts :43 process.env.NB_OAUTH_BOUNCER_TENANT_KEY = randomBytes(32).toString("base64");
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/automations/executor.test.ts :73 process.env.NB_INTERNAL_TOKEN = "test-token-123";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/remote-transport-factory.test.ts :135 key: process.env.NB_MCP_AUTHORIZER_TENANT_KEY,
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/smithery-provider.test.ts :55 process.env.SMITHERY_API_KEY = "sk_test";
secrets (weak) NimbleBrainInc-nimblebrain-d54b14b/test/unit/smithery-teardown.test.ts :68 process.env.SMITHERY_API_KEY = "sk_test";

declared dependencies 37

@modelcontextprotocol/ext-apps@^1.7.5
@modelcontextprotocol/sdk@^1.29.0
@ai-sdk/anthropic@^4.0.0
@ai-sdk/google@^4.0.0
@ai-sdk/openai@^4.0.0
@ai-sdk/openai-compatible@^3.0.0
@ai-sdk/xai@^4.0.0
@composio/core@0.18.0
@e965/xlsx@0.20.3
@nimblebrain/synapse@0.19.0
@opentelemetry/api@1.9.1
@opentelemetry/exporter-trace-otlp-http@0.219.0

show 25 more

@opentelemetry/resources@2.8.0
@opentelemetry/sdk-trace-base@2.8.0
@opentelemetry/sdk-trace-node@2.8.0
@opentelemetry/semantic-conventions@1.41.1
@sentry/bun@^10.58.0
@sinclair/typebox@^0.34.49
@workos-inc/node@^10.0.0
ai@^7.0.0
ajv@^8.18.0
ajv-formats@^3.0.1
croner@^10.0.1
gray-matter@^4.0.3
hono@^4.12.14
mammoth@^1.12.0
posthog-node@^5.28.5
prom-client@^15.1.3
react@^19.2.4
react-dom@^19.2.4
unpdf@^1.6.0
@biomejs/biome@^2.4.10
@types/bun@latest
@types/react@^19.2.14
@types/react-dom@^19.2.3
happy-dom@^20.0.0
typescript@^5.9.3

obfuscation 1

base64 decode → exec sink NimbleBrainInc-nimblebrain-d54b14b/test/unit/platform/files/source.test.ts :202 const pngBytes = Buffer.from(pngBase64, "base64");

perm:untrusted 3

untrusted (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/compaction-wiring.test.ts :168 const metricsBody = await (await fetch(`${baseUrl}/metrics`)).text();
untrusted (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/metrics-endpoint.test.ts :76 const body = await (await fetch(`${baseUrl}/metrics`)).text();
untrusted (weak) NimbleBrainInc-nimblebrain-d54b14b/test/integration/mid-turn-compaction-wiring.test.ts :164 const metricsBody = await (await fetch(`${on.baseUrl}/metrics`)).text();

transport_posture 2

binds all interfaces (0.0.0.0) NimbleBrainInc-nimblebrain-d54b14b/test/unit/cli.test.ts :267 http: { port: 8080, host: "0.0.0.0" },
network-listening, binds all interfaces, no auth detected NimbleBrainInc-nimblebrain-d54b14b/test/unit/config-types.test.ts :36 expect(isValid({ http: { port: 8080, host: "0.0.0.0" } })).toBe(true);