MCP Observatory
8m ago Tracked 26,562 Last 8m ago 24h 1,902
github Rust analyzed 31a33fe unconfirmed MCP

TheStreamCode/chutes-build

github

Privacy-first, open-source coding agent optimized for the Chutes ecosystem

maintainer
TheStreamCode
license
Apache-2.0
first seen
2026-08-01
last seen
2026-08-01
releases · 30d
1
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×6 in TheStreamCode/chutes-build
capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 31a33fe · analyzer v28 · 3h ago

skills & prompt files 7

danger signals6

code evidence vv0.4.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 2303

shell / exec 1

  • shell TheStreamCode-chutes-build-31a33fe/npm/bin/chutes-build.js :6 const { spawnSync } = require('node:child_process');

declared dependencies 200

  • chutes-build-darwin-arm64@0.4.2
  • chutes-build-darwin-x64@0.4.2
  • chutes-build-linux-arm64-gnu@0.4.2
  • chutes-build-linux-x64-gnu@0.4.2
  • chutes-build-win32-arm64@0.4.2
  • chutes-build-win32-x64@0.4.2
  • agent-client-protocol@0.10.4
  • alacritty_terminal@0.26.0
  • ansi-to-tui@7.0.0
  • ansi-width@0.1
  • anstyle@1.0
  • anstyle-lossy@1.1.4
  • anstyle-parse@0.2
  • anstyle-syntect@1.0.4
  • anyhow@1
  • arboard@3.6
  • arc-swap@1.7
  • assert_matches@1.5.0
  • async-compression@0.4.17
  • async-lsp@0.2.3
  • async-openai@0.33.0
  • async-stream@0.3
  • async-trait@0.1
  • axum@0.8
  • backon@1.6
  • backtrace@0.3
  • base64@0.22
  • blake3@1
  • bytes@1
  • camino@1.1.10
  • chrono@0.4
  • clap@4
  • clap_complete@4
  • colored_json@5
  • core-foundation@0.10
  • crc32fast@1.4
  • criterion@0.6
  • crossbeam@0.8
  • crossterm@0.28
  • cryptify@3.2
  • dashmap@6
  • derive_more@2
  • dirs@5.0
  • documented@0.9
  • dunce@1
  • educe@0.6.0
  • enum_delegate@0.2
  • env_logger@0.11
  • eventsource-stream@0.2
  • fastrace@0.7
  • fastrace-opentelemetry@0.18
  • fastrace-reqwest@0.2
  • fastrace-tonic@0.1
  • fastrand@2
  • filetime@0.2.25
  • flate2@1
  • fontdb@0.23
  • fs2@0.4
  • futures@0.3
  • futures-util@0.3
  • fuzzy-matcher@0.3.7
  • gcloud-storage@1.3.0
  • gethostname@1
  • gix@0.83
  • glob@0.3
  • globset@0.4
  • htmd@0.5.4
  • html-escape@0.2
  • http@1
  • http-body-util@0.1
  • humantime-serde@1
  • ignore@0.4
  • image@0.25.9
  • indexmap@2
  • indicatif@0.18
  • infer@0.19.0
  • insta@1
  • itertools@0.14
  • jsonschema@0.30.0
  • libc@0.2
  • linkify@0.10
  • lipsum@0.9
  • log@0.4
  • md5@0.8
  • mermaid-to-svg@*
  • minijinja@2.9
  • mockito@1
  • moka@0.12
  • nix@0.30
  • notify@8
  • notify-debouncer-mini@0.6
  • nucleo@*
  • num_cpus@1
  • oauth2@5
  • obfstr@0.4
  • once_cell@1
  • opentelemetry@0.32
  • opentelemetry-http@0.32
  • opentelemetry-otlp@0.32
  • opentelemetry-proto@0.32
  • opentelemetry_sdk@0.32.1
  • parking_lot@0.12.4
  • pbjson-build@0.9
  • pdf_oxide@0.3.74
  • petgraph@0.6.5
  • portable-pty@0.9
  • pprof@0.15
  • pretty_assertions@1
  • prometheus@0.14
  • prost@0.14
  • prost-build@0.14
  • pulldown-cmark@0.13
  • quick-xml@0.41
  • rand@0.9
  • ratatui@0.29
  • ratatui-core@0.1
  • rayon@1
  • reflink-copy@0.1
  • regex@1
  • reqwest@0.12
  • reqwest-middleware@0.4.1
  • rpassword@7
  • resvg@0.47
  • ring@0.17
  • rsa@0.9
  • runfiles@0.1
  • rustc-hash@2
  • schemars@1
  • scraper@0.27
  • semver@1
  • serde@1
  • serde_json@1
  • serde_path_to_error@0.1
  • serde_yaml@0.9
  • serial_test@3
  • sha2@0.10
  • shlex@1
  • signal-hook@0.3
  • similar@2.7
  • siphasher@1
  • smallvec@1
  • strip-ansi-escapes@0.2.1
  • strum@0.27
  • supports-color@3.0
  • syntect@5.3
  • tar@0.4
  • tempfile@3
  • terminput@0.3
  • termwiz@0.23
  • textwrap@0.16
  • thiserror@2
  • tikv-jemalloc-ctl@0.6
  • tikv-jemalloc-sys@0.6
  • tikv-jemallocator@0.6
  • time@0.3
  • tiny-skia@0.12
  • tokio@1
  • tokio-retry@0.3
  • tokio-stream@0.1
  • tokio-tungstenite@0.27
  • tokio-util@0.7
  • toml@0.9
  • toml_edit@0.22
  • tonic@0.14
  • tonic-prost@0.14
  • tonic-prost-build@0.14
  • tower@0.5
  • tower-http@0.6
  • tracing@0.1
  • tracing-opentelemetry@0.33
  • tracing-subscriber@0.3.23
  • ts-rs@12.0
  • tui-scrollbar@0.2
  • two-face@0.4
  • unicode-segmentation@1.12.0
  • unicode-width@0.2
  • url@2
  • urlencoding@2
  • uuid@1
  • vte@0.15.0
  • wait-timeout@0.2
  • walkdir@2
  • webbrowser@1.0.4
  • which@8
  • whoami@1.4
  • windows@0.61
  • wiremock@0.6
  • wl-clipboard-rs@0.9
  • xai-acp-lib@*
  • xai-agent-lifecycle@*
  • xai-circuit-breaker@*
  • xai-computer-hub-core@*
  • xai-computer-hub-sdk@*
  • xai-gix-status@*
  • xai-grok-agent@*
  • xai-grok-announcements@*
  • xai-grok-auth@*
  • xai-grok-config@*
  • xai-grok-config-types@*
  • xai-grok-env@*