MCP Observatory
2m ago Tracked 55,861 Last 2m ago 24h 2,736
github TypeScript analyzed 2efcd4e

RutvikPansare/Reqly

github

API testing for AI agents. From codebase to CI in one agent session.

maintainer
RutvikPansare
licence
—
first seen
2026-06-28
last seen
2026-09-09
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  2. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  3. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  4. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  5. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  6. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  7. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  8. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  9. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  10. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  11. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  12. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  13. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  14. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  15. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  16. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  17. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  18. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  19. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
  20. HIGH code analysis flagged dynamic code execution in RutvikPansare/Reqly
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 2efcd4e · analyzer v33 · 21h ago

skills & prompt files 3

danger signals1

code evidence vv0.1.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 382

filesystem 82

  • fs RutvikPansare-Reqly-2efcd4e/packages/desktop/src/SetupWizard.ts :3 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/packages/desktop/src/agent-config.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/packages/desktop/src/agent-config.ts :1 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/packages/desktop/src/logger.ts :1 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/packages/desktop/src/main.ts :5 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/packages/desktop/src/reqly-resolver.ts :2 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/packages/vscode/scripts/generate-schemas.mjs :9 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/packages/vscode/src/preview.ts :2 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/packages/vscode/src/schemas.test.ts :3 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/scripts/generate-star-chart.mjs :11 import { writeFileSync } from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/scripts/preview-server.mjs :5 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/auth-manager.test.ts :2 import * as fs from 'fs';
show 28 more
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/auth-manager.ts :1 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/cert-loader.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/cert-loader.ts :1 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/collection-manager.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/collection-manager.ts :1 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/data-runner.test.ts :3 import * as fs from 'fs/promises';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/data-runner.ts :1 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/dotenv-loader.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/dotenv-loader.ts :1 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/environment-manager.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/environment-manager.ts :1 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/flow-manager.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/flow-manager.ts :1 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/framework-detector.test.ts :2 import * as fs from 'fs/promises';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/framework-detector.ts :1 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/grpc-reflection.test.ts :108 import { existsSync } from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/grpc-reflection.ts :3 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/grpc-runner.ts :3 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/history-store.test.ts :3 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/history-store.ts :24 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/http-executor.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/http-executor.ts :3 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/importer.test.ts :2 import * as fs from 'fs/promises';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/importer.ts :1 import * as fs from 'fs/promises';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/mock-server.test.ts :2 import * as fs from 'fs';
  • fs RutvikPansare-Reqly-2efcd4e/src/engine/response-store.ts :1 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/script-file.test.ts :2 import * as fs from 'fs';
  • fs (weak) RutvikPansare-Reqly-2efcd4e/src/engine/script-require.test.ts :67 it('throws clear error for require("fs")', () => {

42 more not shown — this panel samples each group; the count above is the real total.

shell / exec 16

  • shell RutvikPansare-Reqly-2efcd4e/packages/desktop/src/SetupWizard.ts :2 import { execFile } from 'child_process';
  • shell RutvikPansare-Reqly-2efcd4e/packages/desktop/src/main.ts :3 import { spawn, ChildProcess } from 'child_process';
  • shell RutvikPansare-Reqly-2efcd4e/packages/desktop/src/reqly-resolver.ts :1 import { spawnSync } from 'child_process';
  • shell (weak) RutvikPansare-Reqly-2efcd4e/packages/vscode/src/schemas.test.ts :2 import { execSync } from 'child_process';
  • shell (weak) RutvikPansare-Reqly-2efcd4e/scripts/mcp-regression.ts :6 import { spawn } from 'child_process';
  • shell (weak) RutvikPansare-Reqly-2efcd4e/scripts/preview-server.mjs :4 import { spawn } from 'child_process';
  • shell (weak) RutvikPansare-Reqly-2efcd4e/src/engine/process-utils.test.ts :2 import * as childProcess from 'child_process';
  • shell RutvikPansare-Reqly-2efcd4e/src/engine/process-utils.ts :1 import { execSync } from 'child_process';
  • shell (weak) RutvikPansare-Reqly-2efcd4e/src/engine/script-require.test.ts :81 it('throws clear error for require("child_process")', () => {
  • shell RutvikPansare-Reqly-2efcd4e/src/mcp/tools/exec-with-proxy.ts :1 import { spawn } from 'child_process';
  • shell RutvikPansare-Reqly-2efcd4e/src/server/app-command.ts :1 import { exec } from 'child_process';
  • shell RutvikPansare-Reqly-2efcd4e/src/server/exec-command.ts :1 import { spawn } from 'child_process';
show 4 more
  • shell RutvikPansare-Reqly-2efcd4e/src/server/express.ts :511 const { execFile } = await import('child_process');
  • shell (weak) RutvikPansare-Reqly-2efcd4e/src/server/lock.test.ts :5 import { spawn, ChildProcess } from 'child_process';
  • shell (weak) RutvikPansare-Reqly-2efcd4e/test-spawn.cjs :1 const { spawn } = require('child_process');
  • shell (weak) RutvikPansare-Reqly-2efcd4e/tests/e2e/helpers/global-setup.ts :1 import { spawn } from 'child_process';

network 46

  • net RutvikPansare-Reqly-2efcd4e/packages/desktop/src/main.ts :4 import * as http from 'http';
  • net RutvikPansare-Reqly-2efcd4e/packages/reqly-middleware/src/core.ts :33 fetch(`${config.endpoint}/inbound`, {
  • net (weak) RutvikPansare-Reqly-2efcd4e/packages/vscode/src/codelens-detect.test.ts :7 const calls = detectHttpCalls(`const r = await fetch('https://api.example.com/users');`);
  • net RutvikPansare-Reqly-2efcd4e/packages/vscode/src/codelens-detect.ts :20 // fetch( / axios( / axios.get( / got( / got.post( / request(
  • net (weak) RutvikPansare-Reqly-2efcd4e/scripts/generate-star-chart.mjs :27 const res = await fetch(`https://api.github.com/repos/${repo}/stargazers?per_page=100&page=${page}`, {
  • net (weak) RutvikPansare-Reqly-2efcd4e/scripts/mcp-regression.ts :115 const histResp = await fetch(`http://localhost:${TEST_PORT}/api/history`);
  • net RutvikPansare-Reqly-2efcd4e/src/engine/auth-manager.ts :4 import { fetch as undiciFetch } from 'undici';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/code-generator.test.ts :55 expect(code).toContain("fetch('https://api.example.com/users'");
  • net RutvikPansare-Reqly-2efcd4e/src/engine/code-generator.ts :71 `const response = await fetch('${jsq(req.url)}');`,
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/collection-vars.test.ts :10 import { fetch } from 'undici';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/http-executor-secrets.test.ts :11 import { fetch } from 'undici';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/http-executor.test.ts :14 import { fetch, Agent } from 'undici';
show 28 more
  • net RutvikPansare-Reqly-2efcd4e/src/engine/http-executor.ts :1 import { fetch, Agent } from 'undici';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/mock-server.test.ts :5 import * as net from 'net';
  • net RutvikPansare-Reqly-2efcd4e/src/engine/mock-server.ts :2 import { Server } from 'http';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/pre-script.test.ts :6 import { fetch } from 'undici';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/proxy.test.ts :2 import * as http from 'http';
  • net RutvikPansare-Reqly-2efcd4e/src/engine/proxy.ts :1 import * as http from 'http';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/script-file.test.ts :11 import { fetch } from 'undici';
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/engine/script-require.test.ts :74 it('throws clear error for require("axios")', () => {
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/mcp/tools/introspect-graphql.test.ts :56 import { fetch } from 'undici';
  • net RutvikPansare-Reqly-2efcd4e/src/mcp/tools/introspect-graphql.ts :1 import { fetch } from 'undici';
  • net RutvikPansare-Reqly-2efcd4e/src/server/express.ts :7 import * as http from 'http';
  • net RutvikPansare-Reqly-2efcd4e/src/server/status-command.ts :1 import * as net from 'net';
  • net RutvikPansare-Reqly-2efcd4e/src/server/stop-command.ts :13 await fetch(`http://localhost:${lock.port}/api/shutdown`, { method: 'POST' });
  • net (weak) RutvikPansare-Reqly-2efcd4e/src/server/switch-project.test.ts :3 import * as http from 'http';
  • net RutvikPansare-Reqly-2efcd4e/src/server/terminal.ts :2 import { Server } from 'http';
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/App.tsx :333 const res = await fetch('/api/run/adhoc/multipart', { method: 'POST', body: form });
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/api.ts :2 const res = await fetch(`/api/collections?t=${Date.now()}`);
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/CapturePanel.tsx :19 const res = await fetch('/api/mock/status');
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/CollectionRunnerPanel.tsx :17 const res = await fetch('/api/run/collection', {
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/CollectionsPanel/ProjectPathWidget.tsx :44 const res = await fetch('/api/switch-project', {
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/CollectionsPanel/useCollectionState.ts :35 fetch('/api/project').then(r => r.json()).then(d => {
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/EmptyStateNudge.tsx :55 fetch('/api/project').then(r => r.json()).then(setProject).catch(() => {});
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/EnvironmentSwitcher.tsx :74 await fetch('/api/environments', {
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/GraphQLWorkspace.tsx :187 fetch(`/api/schema-cache?url=${encodeURIComponent(url.trim())}`, { signal: controller.signal })
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/GrpcWorkspace.tsx :276 const res = await fetch('/api/run/adhoc', {
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/NavRail.tsx :49 fetch('/api/config')
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/OpenWorkspaceModal.tsx :19 const res = await fetch('/api/open-folder-picker');
  • net RutvikPansare-Reqly-2efcd4e/src/ui/src/components/RequestEditor.tsx :764 const updated = await (await fetch('/api/auth-profiles')).json();

6 more not shown — this panel samples each group; the count above is the real total.

secrets 7

  • secrets (weak) RutvikPansare-Reqly-2efcd4e/scripts/generate-star-chart.mjs :16 const TOKEN = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets (weak) RutvikPansare-Reqly-2efcd4e/src/engine/secret-providers/bitwarden.test.ts :53 const origToken = process.env.BITWARDENSM_ACCESS_TOKEN;
  • secrets RutvikPansare-Reqly-2efcd4e/src/engine/secret-providers/bitwarden.ts :51 const token = process.env.BITWARDENSM_ACCESS_TOKEN || bwConfig?.accessToken;
  • secrets (weak) RutvikPansare-Reqly-2efcd4e/src/engine/secret-providers/onepassword.test.ts :21 const orig = process.env.OP_SERVICE_ACCOUNT_TOKEN;
  • secrets RutvikPansare-Reqly-2efcd4e/src/engine/secret-providers/onepassword.ts :47 const token = process.env.OP_SERVICE_ACCOUNT_TOKEN || config?.secretProviders?.onepassword?.serviceAccountToken;
  • secrets (weak) RutvikPansare-Reqly-2efcd4e/src/engine/secret-providers/vault.test.ts :27 const origToken = process.env.VAULT_TOKEN;
  • secrets RutvikPansare-Reqly-2efcd4e/src/engine/secret-providers/vault.ts :37 const token = process.env.VAULT_TOKEN || vaultConfig?.token;

declared dependencies 41

  • @modelcontextprotocol/sdk@^1.29.0
  • @1password/sdk@^0.4.0
  • @aws-sdk/client-secrets-manager@^3.1079.0
  • @bitwarden/sdk-napi@^1.0.0
  • @grpc/grpc-js@^1.14.4
  • @grpc/proto-loader@^0.8.1
  • @types/multer@^2.1.0
  • ajv@^8.20.0
  • ajv-formats@^3.0.1
  • aws4@^1.13.2
  • chai@^6.2.2
  • chokidar@^5.0.0
show 28 more
  • cors@^2.8.6
  • dotenv@^17.4.2
  • eventsource@^4.1.0
  • express@^5.2.1
  • graphql@^16.8.1
  • graphql-ws@^6.0.8
  • js-yaml@^5.1.0
  • localtunnel@^2.0.2
  • mqtt@^5.15.1
  • multer@^2.2.0
  • node-pty@^1.1.0
  • socket.io-client@^4.8.3
  • swagger-parser@^10.0.3
  • undici@^8.5.0
  • ws@^8.21.0
  • @playwright/test@^1.61.1
  • @types/aws4@^1.11.6
  • @types/chai@^5.2.3
  • @types/cors@^2.8.19
  • @types/express@^5.0.6
  • @types/js-yaml@^4.0.9
  • @types/localtunnel@^2.0.4
  • @types/node@^26.0.0
  • @types/supertest@^7.2.0
  • @types/ws@^8.18.1
  • supertest@^7.2.2
  • tsx@^4.22.4
  • typescript@^6.0.3

1 more not shown — this panel samples each group; the count above is the real total.

perm:untrusted 2

  • untrusted (weak) RutvikPansare-Reqly-2efcd4e/tests/e2e/helpers/global-setup.ts :13 const occupied = await fetch(`http://localhost:${UI_PORT}/api/collections`).then(() => true).catch(() => false);
  • untrusted (weak) RutvikPansare-Reqly-2efcd4e/tests/e2e/mcp-regression.ts :191 const afterStop = await fetch(`http://localhost:${MOCK_PORT}/users`).then(() => true).catch(() => false);