MCP Observatory
5m ago Tracked 58,723 Last 5m ago 24h 2,553
github Rust re-analysis due unconfirmed MCP

OpenCoven/coven-code

github

Open-source, multi-provider AI coding-agent TUI in Rust.

maintainer
OpenCoven
licence
GPL-3.0
first seen
2026-09-15
last seen
2026-09-16
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in OpenCoven/coven-code
  2. HIGH code analysis flagged committed secret in OpenCoven/coven-code
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 82df971 · analyzer v33 · 2h ago

skills & prompt files 18

danger signals1

code evidence vv0.7.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 289

filesystem 5

  • fs OpenCoven-coven-code-82df971/npm/install.js :5 const fs = require('fs');
  • fs (weak) OpenCoven-coven-code-82df971/scripts/familiar-contract-docs.test.mjs :2 import fs from 'node:fs';
  • fs (weak) OpenCoven-coven-code-82df971/scripts/mascot-rebrand.test.mjs :2 import fs from 'node:fs';
  • fs (weak) OpenCoven-coven-code-82df971/scripts/prepare-npm-package.mjs :1 import fs from 'node:fs';
  • fs (weak) OpenCoven-coven-code-82df971/scripts/prepare-npm-package.test.mjs :2 import fs from 'node:fs';

shell / exec 3

  • shell (weak) OpenCoven-coven-code-82df971/docs/src/demos.js :463 { id: 'command', category: 'Transport', desc: 'Required for stdio. Executable to spawn (e.g. "npx", "uvx", "python", absolute paths). Ignored for http transport.',
  • shell OpenCoven-coven-code-82df971/npm/install.js :9 const { execFileSync } = require('child_process');
  • shell (weak) OpenCoven-coven-code-82df971/scripts/prepare-npm-package.test.mjs :5 import { spawnSync } from 'node:child_process';

network 3

  • net (weak) OpenCoven-coven-code-82df971/docs/src/hero.js :106 const res = await fetch('/api/stars');
  • net (weak) OpenCoven-coven-code-82df971/docs/worker/index.ts :7 async fetch(request): Promise<Response> {
  • net OpenCoven-coven-code-82df971/npm/install.js :4 const https = require('https');

install hooks 1

  • postinstall OpenCoven-coven-code-82df971/npm/package.json :30 node install.js

declared dependencies 70

  • alpinejs@^3.15.12
  • @cloudflare/vite-plugin@1.25.1
  • @tailwindcss/vite@4.1.18
  • tailwindcss@4.1.18
  • vite@6.4.2
  • wrangler@4.66.0
  • tokio@1.44
  • tokio-stream@0.1
  • futures@0.3
  • async-trait@0.1
  • async-stream@0.3
  • reqwest@0.13
show 28 more
  • serde@1
  • serde_json@1
  • toml@0.8
  • clap@4
  • ratatui@0.29
  • crossterm@0.29
  • anyhow@1
  • thiserror@2
  • tracing@0.1
  • tracing-subscriber@0.3
  • uuid@1
  • chrono@0.4
  • regex@1
  • glob@0.3
  • walkdir@2
  • tempfile@3
  • dirs@5
  • which@7
  • once_cell@1
  • parking_lot@0.12
  • dashmap@6
  • indexmap@2
  • bytes@1
  • base64@0.22
  • sha2@0.10
  • hex@0.4
  • getrandom@0.2
  • enigo@0.2

30 more not shown — this panel samples each group; the count above is the real total.