MCP Observatory
4m ago Tracked 60,039 Last 4m ago 24h 2,475
github Go re-analysis due

Nox-HQ/nox

github

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.

maintainer
Nox-HQ
licence
Apache-2.0
first seen
2026-06-05
last seen
2026-09-18
releases · 30d
9
short id

Drift inferred · capture-to-capture

tool count over time

06-05 18:15 now
7t
8t
capabilities 8 tools
transport stdio counts 8 tools · 0 res · 0 prompts permission surface via README inference

tools

  • attack_plan

    path

  • baseline_add

    path, fingerprint, reason

  • baseline_status

    path

  • get_finding_detail

    finding_id, context_lines

  • get_findings

    format (json\

  • get_sbom

    format (cdx\

  • list_findings

    severity, rule, file, limit

  • scan

    path (required)

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit fe005f3 · analyzer v33 · 15h ago

skills & prompt files 2

danger signals28

code evidence vv1.36.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1277

shell / exec 4

  • shell (weak) Nox-HQ-nox-fe005f3/testdata/metamorphic-corpus/javascript/routes.js :2 const { exec } = require("child_process");
  • shell (weak) Nox-HQ-nox-fe005f3/testdata/precision-suite/clean_inline_sanitizer.js :3 const child_process = require('child_process');
  • shell (weak) Nox-HQ-nox-fe005f3/testdata/precision-suite/tp_import_idioms.js :3 // The corpus tested only `const child_process = require("child_process")` — the
  • shell (weak) Nox-HQ-nox-fe005f3/testdata/precision-suite/tp_shell_argv.js :3 const { spawn } = require("child_process");

secrets 1

  • secrets (weak) Nox-HQ-nox-fe005f3/examples/multi-stack/frontend/src/chat.ts :9 apiKey: process.env.OPENAI_API_KEY,

declared dependencies 51

  • vscode-languageclient@^10.1.1
  • @types/node@^26.2.0
  • @types/vscode@^1.136.0
  • typescript@^7.0.2
  • github.com/charmbracelet/bubbles@v1.0.0
  • github.com/charmbracelet/bubbletea@v1.3.10
  • github.com/charmbracelet/lipgloss@v1.1.0
  • github.com/fsnotify/fsnotify@v1.10.1
  • github.com/openai/openai-go/v3@v3.61.0
  • golang.org/x/sync@v0.23.0
  • golang.org/x/term@v0.46.0
  • golang.org/x/time@v0.16.0
show 28 more
  • google.golang.org/grpc@v1.83.2
  • google.golang.org/protobuf@v1.36.12
  • gopkg.in/yaml.v3@v3.0.1
  • github.com/aymanbagabas/go-osc52/v2@v2.0.1
  • github.com/cespare/xxhash/v2@v2.3.0
  • github.com/charmbracelet/colorprofile@v0.4.3
  • github.com/charmbracelet/x/ansi@v0.11.8
  • github.com/charmbracelet/x/cellbuf@v0.0.15
  • github.com/charmbracelet/x/term@v0.2.2
  • github.com/clipperhouse/displaywidth@v0.11.0
  • github.com/clipperhouse/uax29/v2@v2.7.0
  • github.com/erikgeiser/coninput@v0.0.0-20211004153227-1c3628e74d0f
  • github.com/go-logr/logr@v1.4.4
  • github.com/go-logr/stdr@v1.2.2
  • github.com/gorilla/websocket@v1.5.3
  • github.com/lucasb-eyer/go-colorful@v1.4.1
  • github.com/mattn/go-isatty@v0.0.24
  • github.com/mattn/go-localereader@v0.0.1
  • github.com/mattn/go-runewidth@v0.0.28
  • github.com/muesli/ansi@v0.0.0-20230316100256-276c6243b2f6
  • github.com/muesli/cancelreader@v0.2.2
  • github.com/muesli/termenv@v0.16.0
  • github.com/nox-hq/nox-core@v0.3.1
  • github.com/rivo/uniseg@v0.4.7
  • github.com/tidwall/gjson@v1.19.0
  • github.com/tidwall/match@v1.2.0
  • github.com/tidwall/pretty@v1.2.1
  • github.com/tidwall/sjson@v1.2.5

11 more not shown — this panel samples each group; the count above is the real total.

jetbrains-plugin 1

  • opaque (low) Nox-HQ-nox-fe005f3/editors/jetbrains/src/main/resources/META-INF/plugin.xml bundled JetBrains plugin "nox" (Nox-HQ-nox-fe005f3/editors/jetbrains/src/main/resources/META-INF/plugin.xml) — presence-detected; review the plugin descriptor