MCP Observatory
4m ago Tracked 47,911 Last 4m ago 24h 2,658
github JavaScript analyzed 8aebc6b unconfirmed MCP

SakuraByteCore/codexmate

github

One dashboard for all your local AI coding agents. Switch providers, manage sessions, and orchestrate tasks across Codex, Claude Code, Gemini CLI, CodeBuddy Code, Pi, OpenCode, KiloCode, and OpenClaw. Zero cloud, local-first control plane.

maintainer
SakuraByteCore
license
Apache-2.0
first seen
2026-06-02
last seen
2026-08-25
releases · 30d
9
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 8aebc6b · analyzer v33 · 1d ago

skills & prompt files 1

danger signals1

code evidence vv0.1.14 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 238

filesystem 71

  • fs SakuraByteCore-codexmate-8aebc6b/cli.js :2 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/archive-helpers.js :213 const stream = fs.createWriteStream(zipPath);
  • fs SakuraByteCore-codexmate-8aebc6b/cli/import-skills-url.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/local-bridge.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/session-convert-args.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/session-convert-io.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/session-convert.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/session-usage.models.js :143 content = await fs.promises.readFile(targetPath, 'utf-8');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/skills.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/update.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/cli/zip-commands.js :312 const writeStream = fs.createWriteStream(outputPath);
  • fs SakuraByteCore-codexmate-8aebc6b/lib/cli-file-utils.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/lib/cli-path-utils.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/lib/cli-sessions.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/lib/cli-utils.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/lib/cli-webhook.js :2 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/lib/download-artifacts.js :1 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/lib/win-tray.js :4 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/helpers.js :1 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/recent-health.e2e.js :4 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/run.js :3 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-claude-proxy.js :1 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-claude.js :1 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-health-speed.js :64 const originalConfig = require('fs').readFileSync(configPath, 'utf-8');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-mcp.js :2 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-openclaw.js :1 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-session-convert-derived.js :2 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-sessions.js :2 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-setup.js :2 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-task-orchestration.js :15 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-web-ui-session-browser.js :1 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-web-ui-usage-interactions.js :3 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/agents-files-project.test.mjs :6 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/automation.test.mjs :5 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/builtin-proxy-responses-shim.test.mjs :11 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/ci-workflow-contract.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/claude-proxy-adapter.test.mjs :606 try { require('fs').rmSync(settingsFile, { force: true }); } catch (_) {}
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/coderabbit-workflows.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/codex-proxy-options.test.mjs :10 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/context-recovery-skill.test.mjs :3 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/helpers/web-ui-app-options.mjs :1 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/i18n-locales.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/kilocode-config-cli.test.mjs :3 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/lint-contract.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/local-bridge-claude-target-api.test.mjs :5 import { mkdtemp, writeFile, rm } from 'node:fs/promises';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/npm-package-files.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/openai-bridge-upstream-responses.test.mjs :5 import { mkdtemp, writeFile, rm } from 'node:fs/promises';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/opencode-provider-store-backend.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/plugins-ownership-contract.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/plugins-registry-contract.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/readme-docs-consistency.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/release-changelog.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/reset-main.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/session-convert.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/session-detail-preview-fast.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/session-header-actions-layout.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/session-query.test.mjs :10 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/session-usage-backend.test.mjs :9 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/system-prompt-files.test.mjs :6 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/task-workspace-chat.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/unzip-ext.test.mjs :2 import fs from 'fs';
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/web-run-host.test.mjs :9 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/web-ui-restart.test.mjs :9 const fs = require('fs');
  • fs (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/web-ui-source-bundle.test.mjs :2 import fs from 'fs';
  • fs SakuraByteCore-codexmate-8aebc6b/tools/ci/ensure-test-deps.js :2 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/tools/dev/generate-plugins-registry.js :2 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/tools/dev/lint.js :2 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/tools/generate-zh-tw.mjs :1 import { readFileSync, writeFileSync } from 'fs';
  • fs SakuraByteCore-codexmate-8aebc6b/tools/release/changelog.js :2 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/tools/release/publish-npm.js :2 const fs = require('fs');
  • fs SakuraByteCore-codexmate-8aebc6b/web-ui/source-bundle.cjs :1 const fs = require('fs');

shell / exec 27

  • shell SakuraByteCore-codexmate-8aebc6b/cli.js :10 const { exec, execSync, execFileSync, spawn, spawnSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/cli/archive-helpers.js :346 execFileSync(zipTool.cmd, ['-0', '-q', '-r', zipFilePath, dirPath], { stdio: 'ignore' });
  • shell SakuraByteCore-codexmate-8aebc6b/cli/skills.js :7 const { execSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/cli/update.js :5 const { execSync, spawn } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/cli/zip-commands.js :80 execSync(cmd, { stdio: 'ignore' });
  • shell SakuraByteCore-codexmate-8aebc6b/lib/cli-path-utils.js :3 const { spawnSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/lib/win-tray.js :3 const { spawn } = require('child_process');
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/helpers.js :5 const { spawnSync, spawn } = require('child_process');
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/recent-health.e2e.js :5 const { spawn } = require('child_process');
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/run.js :1 const { spawn } = require('child_process');
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-config.js :1 const { spawn } = require('child_process');
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-mcp.js :1 const { spawnSync } = require('child_process');
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-task-orchestration.js :1 const { spawn } = require('child_process');
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/cli-help.test.mjs :3 import { spawnSync } from 'child_process';
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/context-recovery-skill.test.mjs :6 import { execFileSync } from 'child_process';
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/helpers/web-ui-app-options.mjs :4 import { execFileSync } from 'child_process';
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/kilocode-config-cli.test.mjs :6 import { spawnSync } from 'child_process';
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/opencode-provider-store-backend.test.mjs :6 import { spawn } from 'child_process';
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/unzip-ext.test.mjs :5 import { spawnSync } from 'child_process';
  • shell (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/web-run-host.test.mjs :291 spawnSync(command, args) {
  • shell SakuraByteCore-codexmate-8aebc6b/tools/ci/ensure-test-deps.js :4 const { spawnSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/tools/ci/run-check.js :3 const { spawnSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/tools/dev/lint.js :4 const { spawnSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/tools/dev/reset-and-dev.js :3 const { execSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/tools/dev/reset-main.js :8 const { execSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/tools/release/changelog.js :3 const { execFileSync } = require('child_process');
  • shell SakuraByteCore-codexmate-8aebc6b/tools/release/publish-npm.js :5 const { spawnSync } = require('child_process');

network 28

  • net SakuraByteCore-codexmate-8aebc6b/cli.js :11 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/cli/builtin-proxy.js :1 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/cli/claude-proxy.js :1 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/cli/import-skills-url.js :4 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/cli/local-bridge.js :2 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/cli/openai-bridge-runtime.js :1 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/cli/openai-bridge.js :1 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/cli/update.js :4 const https = require('https');
  • net SakuraByteCore-codexmate-8aebc6b/lib/cli-network-utils.js :1 const http = require('http');
  • net SakuraByteCore-codexmate-8aebc6b/lib/cli-webhook.js :3 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/helpers.js :3 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/recent-health.e2e.js :1 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-claude-proxy.js :3 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-messages.js :3 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-session-search.js :1 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-task-orchestration.js :14 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-web-ui-assets.js :1 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-web-ui-session-browser.js :104 return async function fetch(_url, init = {}) {
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-web-ui-url-routing.js :1 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/e2e/test-webhook.js :1 const http = require('http');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/builtin-proxy-responses-shim.test.mjs :3 import http from 'node:http';
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/claude-proxy-adapter.test.mjs :2 import http from 'http';
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/cli-network-utils.test.mjs :11 const https = require('https');
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/local-bridge-claude-target-api.test.mjs :2 import http from 'node:http';
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/openai-bridge-upstream-responses.test.mjs :3 import http from 'node:http';
  • net (weak) SakuraByteCore-codexmate-8aebc6b/tests/unit/opencode-provider-store-backend.test.mjs :5 import http from 'http';
  • net SakuraByteCore-codexmate-8aebc6b/web-ui/modules/api.mjs :8 return await fetch(`${API_BASE}/api`, {
  • net SakuraByteCore-codexmate-8aebc6b/web-ui/modules/skills.methods.mjs :322 const response = await fetch(`/api/import-skills-zip?targetApp=${encodeURIComponent(this.skillsTargetApp)}`, {

secrets 4

  • secrets SakuraByteCore-codexmate-8aebc6b/cli.js :371 expectedToken: typeof process.env.CODEXMATE_HTTP_TOKEN === 'string' ? process.env.CODEXMATE_HTTP_TOKEN.trim() : '',
  • secrets SakuraByteCore-codexmate-8aebc6b/cli/builtin-proxy.js :2110 const expected = typeof process.env.CODEXMATE_HTTP_TOKEN === 'string'
  • secrets SakuraByteCore-codexmate-8aebc6b/cli/claude-proxy.js :1466 const expected = typeof process.env.CODEXMATE_HTTP_TOKEN === 'string'
  • secrets SakuraByteCore-codexmate-8aebc6b/tools/release/publish-npm.js :46 const token = (process.env.NPM_TOKEN || '').trim() || readNpmTokenFromNpmrc(localNpmrc);

declared dependencies 7

  • @iarna/toml@^2.2.5
  • json5@^2.2.3
  • yauzl@^3.2.1
  • zip-lib@^1.2.1
  • @vue/compiler-dom@^3.5.34
  • opencc-js@^1.3.1
  • vitepress@^1.6.4

obfuscation 4

  • dynamic require()/import() SakuraByteCore-codexmate-8aebc6b/tests/unit/helpers/web-ui-app-options.mjs :249 await import(`${pathToFileURL(tempFile).href}?t=${Date.now()}-${Math.random()}`);
  • dynamic require()/import() SakuraByteCore-codexmate-8aebc6b/tests/unit/plugins-ownership-contract.test.mjs :36 const { pluginMeta } = await import(`${manifestUrl}?t=${Date.now()}`);
  • dynamic require()/import() SakuraByteCore-codexmate-8aebc6b/tests/unit/prompt-templates-ownership-contract.test.mjs :25 const ownershipMod = await import(`${ownershipUrl}?t=${Date.now()}`);
  • dynamic require()/import() SakuraByteCore-codexmate-8aebc6b/tests/unit/web-ui-source-bundle.test.mjs :115 const moduleNs = await import(`${pathToFileURL(tempFile).href}?t=${Date.now()}`);