github Python analyzed 7aa307c deep scan unknown

Q00/ouroboros

github

Agent OS: the agent gets smarter on its own. We just hold the line: Interview-gated, staged evaluation, budgeted evolution loop. MCP server, 14 runtimes: Claude Code, Codex CLI, Gemini CLI, OpenCode, Copilot, Kiro and more.

maintainer
Q00
licence
MIT
first seen
2026-06-01
last seen
2026-09-09
releases · 30d
19
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  2. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  3. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  4. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  5. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  6. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  7. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  8. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  9. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  10. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  11. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  12. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  13. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  14. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  15. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  16. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  17. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  18. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  19. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
  20. HIGH code analysis flagged dynamic code execution in Q00/ouroboros
capabilities 0 tools
transport stdio · streamable-http · sse verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 7aa307c · analyzer v33 · 16h ago

skills & prompt files 26

danger signals13

code evidence vv0.54.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1450

filesystem 400

  • fs (weak) Q00-ouroboros-7aa307c/examples/task_manager/storage.py :8 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/check-auto-boundary.py :78 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/check-auto-perf-budget.py :35 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/check-max-turns-envelope.py :48 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/check-module-size.py :67 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/check-pr-issue-link.py :51 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/deleak_toolsearch.py :15 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/drift-monitor.py :14 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/export_interview_latency.py :16 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/keyword-detector.py :16 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/manual-synapse-smoke.py :18 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/manual-synapse-state-smoke.py :16 from pathlib import Path
show 28 more
  • fs (weak) Q00-ouroboros-7aa307c/scripts/ralph.py :20 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/session-start.py :10 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/sync-plugin-version.py :21 from pathlib import Path
  • fs (weak) Q00-ouroboros-7aa307c/scripts/version-check.py :14 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/agents/loader.py :19 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/adapters.py :10 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/checkpoint_commits.py :6 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/domain_profile.py :22 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/ledger_seed.py :5 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/profiles/coding.py :12 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/profiles/research.py :11 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/repo_context.py :5 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/seed_preflight.py :30 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/seed_preflight_gate.py :6 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/state.py :11 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/auto/trace_export.py :34 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/backends/model_catalog.py :29 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/bigbang/brownfield.py :19 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/bigbang/explore.py :17 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/bigbang/interview.py :12 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/bigbang/pm_document.py :15 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/bigbang/pm_interview.py :26 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/bigbang/seed_generator.py :17 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/artifacts.py :7 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/auto.py :9 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/claude_setup.py :3 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/cleanup.py :26 from pathlib import Path
  • fs Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/codex.py :12 from pathlib import Path

360 more not shown — this panel samples each group; the count above is the real total.

shell / exec 128

  • shell (weak) Q00-ouroboros-7aa307c/scripts/check-auto-perf-budget.py :37 import subprocess
  • shell (weak) Q00-ouroboros-7aa307c/scripts/check-module-size.py :68 import subprocess
  • shell (weak) Q00-ouroboros-7aa307c/scripts/ralph-rewind.py :20 import subprocess
  • shell (weak) Q00-ouroboros-7aa307c/scripts/ralph.py :60 import subprocess
  • shell (weak) Q00-ouroboros-7aa307c/scripts/sync-plugin-version.py :24 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/auto/checkpoint_commits.py :8 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/backends/model_catalog.py :31 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/bigbang/brownfield.py :20 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/mcp.py :18 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/mcp_doctor.py :405 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/plugin.py :25 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/plugin_cache.py :21 import subprocess
show 28 more
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/setup.py :28 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/tui.py :13 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/update.py :23 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/omp_config.py :6 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/opencode_config.py :13 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/cli/windows_codex_mcp.py :8 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/codex/runtime_profile.py :26 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/copilot/model_discovery.py :32 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/core/git_workflow.py :150 import subprocess # noqa: S404
  • shell Q00-ouroboros-7aa307c/src/ouroboros/core/pm_snapshot.py :21 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/core/project_identity.py :20 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/core/worktree.py :12 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/dashboard_web/daemon.py :27 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/evolution/frugality.py :23 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/mcp/detached_jobs.py :24 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/mcp/server/adapter.py :2114 import subprocess # noqa: S404 # nosec
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/cli_version_attestation.py :13 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/codex_cli_runtime.py :18 import subprocess # noqa: F401 # compatibility: tests patch this shared module
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/context_pack.py :29 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/evidence/system.py :6 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/evidence/test_detection.py :447 subprocess.run([..., 'tool.py', ...])``) all reference the artifact the
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/heartbeat.py :126 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/kiro_adapter.py :77 # Session ids flow from subprocess output into argv on the next resume turn;
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/n_version_tournament.py :40 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/opencode_runtime.py :31 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/pi_runtime.py :19 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/runtime_evidence.py :37 import subprocess
  • shell Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/verifier.py :38 import subprocess

88 more not shown — this panel samples each group; the count above is the real total.

network 30

  • net (weak) Q00-ouroboros-7aa307c/scripts/export_interview_latency.py :20 from urllib.parse import quote
  • net (weak) Q00-ouroboros-7aa307c/scripts/version-check.py :139 import urllib.request
  • net Q00-ouroboros-7aa307c/src/ouroboros/bigbang/brownfield.py :21 from urllib.parse import urlparse
  • net Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/mcp.py :17 import socket
  • net Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/update.py :27 import urllib.request
  • net Q00-ouroboros-7aa307c/src/ouroboros/config_tui/launcher.py :17 import socket
  • net Q00-ouroboros-7aa307c/src/ouroboros/copilot/model_discovery.py :34 import urllib.error
  • net Q00-ouroboros-7aa307c/src/ouroboros/core/worktree.py :11 import socket
  • net Q00-ouroboros-7aa307c/src/ouroboros/dashboard_web/daemon.py :26 import socket
  • net Q00-ouroboros-7aa307c/src/ouroboros/dashboard_web/launcher.py :9 import socket
  • net Q00-ouroboros-7aa307c/src/ouroboros/dashboard_web/reader.py :19 from urllib.parse import quote
  • net Q00-ouroboros-7aa307c/src/ouroboros/dashboard_web/server.py :20 from urllib.parse import parse_qs, urlparse
show 18 more
  • net Q00-ouroboros-7aa307c/src/ouroboros/evolution/provider_usage.py :25 from urllib.parse import urlsplit
  • net Q00-ouroboros-7aa307c/src/ouroboros/mcp/tools/citation_check.py :26 import urllib.error
  • net Q00-ouroboros-7aa307c/src/ouroboros/mcp/types.py :14 import socket
  • net Q00-ouroboros-7aa307c/src/ouroboros/mcp/update_notice.py :29 import urllib.request
  • net Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/backend_outcomes.py :32 from urllib.parse import quote
  • net Q00-ouroboros-7aa307c/src/ouroboros/persistence/event_store.py :19 from urllib.parse import quote, unquote
  • net Q00-ouroboros-7aa307c/src/ouroboros/persistence/sqlite_memory.py :8 from urllib.parse import unquote_to_bytes, urlencode
  • net Q00-ouroboros-7aa307c/src/ouroboros/providers/litellm_adapter.py :22 import httpx
  • net Q00-ouroboros-7aa307c/src/ouroboros/telemetry.py :33 import urllib.request
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/cli/test_cleanup.py :81 import socket
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/cli/test_mcp_stdin_peer_probe.py :13 import socket
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/cli/test_update.py :149 "ouroboros.cli.commands.update.urllib.request.urlopen",
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/copilot/test_model_discovery.py :96 "urllib.request.urlopen",
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/evolution/test_provider_usage.py :1050 assert settings["dependency_transport_contract"] == "ouroboros.httpx.async.v1"
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/mcp/test_types.py :3 import socket
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/scripts/test_version_check.py :76 patch("urllib.request.urlopen", return_value=mock_response),
  • net (weak) Q00-ouroboros-7aa307c/tests/unit/test_telemetry.py :10 import socket
  • net Q00-ouroboros-7aa307c/tools/sync_github_project.py :20 import urllib.error

secrets 12

  • secrets Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/mcp_doctor.py :296 openai_key_present = bool(os.environ.get("OPENAI_API_KEY", "").strip())
  • secrets Q00-ouroboros-7aa307c/src/ouroboros/cli/commands/status.py :849 if os.environ.get("OPENAI_API_KEY", "").strip():
  • secrets Q00-ouroboros-7aa307c/src/ouroboros/evaluation/consensus.py :93 key = os.environ.get("OPENROUTER_API_KEY", "")
  • secrets Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/adapter.py :1180 self._api_key = api_key or os.getenv("ANTHROPIC_API_KEY")
  • secrets Q00-ouroboros-7aa307c/src/ouroboros/providers/anthropic_adapter.py :154 self._api_key = api_key or os.environ.get("ANTHROPIC_API_KEY")
  • secrets Q00-ouroboros-7aa307c/src/ouroboros/providers/codex_cli_adapter.py :675 "openai_api_key_present": cls._redact_env_presence(os.environ.get("OPENAI_API_KEY")),
  • secrets Q00-ouroboros-7aa307c/src/ouroboros/providers/litellm_adapter.py :730 env_key = self._normalize_api_key(os.environ.get("OPENROUTER_API_KEY"))
  • secrets Q00-ouroboros-7aa307c/src/ouroboros/telemetry.py :405 return os.environ.get("OUROBOROS_POSTHOG_API_KEY", "").strip() or _EMBEDDED_API_KEY
  • secrets (weak) Q00-ouroboros-7aa307c/tests/unit/cli/test_mcp_shell_env.py :80 assert os.environ["SOME_VENDOR_API_KEY"] == "sk-secret"
  • secrets (weak) Q00-ouroboros-7aa307c/tests/unit/config/test_loader_env.py :85 assert os.environ["OPENROUTER_API_KEY"] == "real-key"
  • secrets (weak) Q00-ouroboros-7aa307c/tests/unit/copilot/test_model_discovery.py :294 os.environ["GH_TOKEN"] = "gh_value"
  • secrets Q00-ouroboros-7aa307c/tools/sync_github_project.py :27 token = os.getenv("GITHUB_TOKEN")

database 32

  • db (weak) Q00-ouroboros-7aa307c/scripts/export_interview_latency.py :17 import sqlite3
  • db Q00-ouroboros-7aa307c/src/ouroboros/dashboard_web/reader.py :17 import sqlite3
  • db Q00-ouroboros-7aa307c/src/ouroboros/evolution/generation_claims.py :52 from sqlalchemy import delete, select, text, update
  • db Q00-ouroboros-7aa307c/src/ouroboros/orchestrator/backend_outcomes.py :31 import sqlite3
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/artifact_store.py :27 import sqlite3
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/backend_contract.py :17 from sqlalchemy.engine import make_url
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/brownfield.py :14 from sqlalchemy import delete, literal_column, select, update
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/event_store.py :17 import sqlite3
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/lineage_claims.py :11 from sqlalchemy import delete, func, insert, select, update
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/migrations/runner.py :10 from sqlalchemy import text
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/picker_index_provisioning.py :7 from sqlalchemy.engine import Connection
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/picker_indexes.py :13 import sqlite3
show 20 more
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/picker_projection_updates.py :10 from sqlalchemy import Column, Integer, MetaData, literal_column
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/schema.py :16 from sqlalchemy import (
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/session_signal_store.py :8 from sqlalchemy import select
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/sqlite_connection.py :5 import sqlite3
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/sqlite_memory.py :6 import sqlite3
  • db Q00-ouroboros-7aa307c/src/ouroboros/persistence/write_settlement.py :19 from sqlalchemy.exc import OperationalError
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/cli/test_job_command.py :13 from sqlalchemy import text
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/cli/test_resume.py :7 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/cli/test_status.py :9 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/dashboard_web/test_daemon.py :8 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/dashboard_web/test_reader_readonly_uri.py :7 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/dashboard_web/test_server.py :9 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/evolution/test_generation_ownership.py :49 from sqlalchemy import update as sa_update
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/evolution/test_lineage_single_writer.py :14 from sqlalchemy import func, select
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/orchestrator/test_backend_outcomes.py :8 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/orchestrator/test_disposable_memory.py :13 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/persistence/test_artifact_store.py :14 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/persistence/test_event_store.py :8 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/persistence/test_picker_indexes.py :9 import sqlite3
  • db (weak) Q00-ouroboros-7aa307c/tests/unit/scripts/test_export_interview_latency.py :9 import sqlite3

declared dependencies 22

  • mcp@==1.28.1
  • aiosqlite@>=0.20.0,<1.0.0
  • anyio@>=4.0.0,<5.0.0
  • click@>=8.1.0,<9.0.0
  • jsonschema@>=4.21.0,<5.0.0
  • pydantic@>=2.0.0,<3.0.0
  • prompt-toolkit@>=3.0.0,<4.0.0
  • python-dotenv@>=1.2.2,<1.3.0
  • pyyaml@>=6.0.0,<7.0.0
  • rich@>=13.0.0,<16.0.0
  • sqlalchemy@>=2.0.0,<3.0.0
  • structlog@>=24.0.0,<27.0.0
show 10 more
  • typer@>=0.12.0,<0.28.0
  • claude-agent-sdk@==0.2.144
  • anthropic@==0.122.0
  • litellm@==1.91.0; python_version <
  • textual@==8.2.8
  • textual-serve@==1.1.3
  • ouroboros-ai@*
  • superlighttui@0.7.1
  • rusqlite@0.33
  • serde_json@1

transport_posture 2

  • network-listening, binds all interfaces, no auth detected Q00-ouroboros-7aa307c/tests/unit/config_tui/test_launcher.py :237 launcher.launch_settings(force_web=True, host="0.0.0.0", port=8765, open_browser=False)
  • binds all interfaces (0.0.0.0) Q00-ouroboros-7aa307c/tests/unit/mcp/server/test_network_security.py :194 await adapter.serve(transport="streamable-http", host="0.0.0.0", port=9000)