github TypeScript analyzed 78a04e9 unconfirmed MCP

TraX22/HydraOps

Self-hosted multi-agent AI system with a chat interface. Agents with editable personalities run tasks across API and local LLMs, behind a credential firewall.

maintainer: TraX22
licence: Apache-2.0
first seen: 2026-08-12
last seen: 2026-09-09
releases · 30d: 23
short id

Drift inferred · capture-to-capture

HIGH 2026-09-09 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-09 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-08 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-06 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-06 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-05 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-05 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-05 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-05 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-05 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-04 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-04 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-03 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-02 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-01 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-01 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-01 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-01 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-09-01 code analysis flagged committed secret in TraX22/HydraOps
HIGH 2026-08-31 code analysis flagged committed secret in TraX22/HydraOps

capabilities 0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 78a04e9 · analyzer v33 · 16h ago

danger signals4

dynamic code execution eval() TraX22-HydraOps-78a04e9/packages/addons/src/my_addons/calculator/index.ts :17 const result = eval(expression);
suspicious endpoint api.telegram.org TraX22-HydraOps-78a04e9/apps/api/src/index.ts :2164 const r = await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
suspicious endpoint api.telegram.org TraX22-HydraOps-78a04e9/apps/telegram-bot/src/index.ts :123 const res = await fetch(`https://api.telegram.org/bot${token}/${method}`, {
committed secret Google API key TraX22-HydraOps-78a04e9/packages/addons/src/native/youtube_transcript/index.ts :17 AIzaSy…(39 chars, redacted)

code evidence vv0.1.22 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 97

filesystem 22

fs TraX22-HydraOps-78a04e9/apps/api/src/index.ts :5 import { readdir, readFile, writeFile, mkdir, rm, access, rename } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/apps/desktop/src/data-dir.js :15 const fs = require("node:fs");
fs TraX22-HydraOps-78a04e9/apps/desktop/src/main.js :8 const fs = require("node:fs");
fs TraX22-HydraOps-78a04e9/apps/desktop/src/self-update.js :17 const fs = require("node:fs");
fs TraX22-HydraOps-78a04e9/apps/desktop/src/services.js :20 const fs = require("node:fs");
fs TraX22-HydraOps-78a04e9/apps/desktop/tools/make-icon.js :13 const fs = require("node:fs");
fs TraX22-HydraOps-78a04e9/apps/key-proxy/src/index.ts :15 import { readFile, stat } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/apps/orchestrator/src/index.ts :7 import { readdir } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/apps/outbox-worker/src/index.ts :12 import { createWriteStream, mkdirSync } from "node:fs";
fs TraX22-HydraOps-78a04e9/apps/telegram-bot/src/index.ts :5 import { readFile } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/apps/worker-coder/src/index.ts :4 import { mkdir, writeFile, readFile } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/apps/worker-general/src/index.ts :7 import { mkdir, writeFile, readFile, readdir } from "node:fs/promises";

show 10 more

fs TraX22-HydraOps-78a04e9/apps/worker-graphic/src/index.ts :8 import { mkdir, writeFile, readFile } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/apps/worker-video/src/index.ts :9 import { mkdir, writeFile, readFile } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/packages/addons/src/loader.ts :1 import { readdir, stat } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/packages/addons/src/native/remember/index.ts :2 import { appendFile, readFile, stat } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/packages/config/src/local-llm.ts :14 import { readFileSync, statSync } from "node:fs";
fs TraX22-HydraOps-78a04e9/packages/db/src/seed-agent-configs.ts :11 import { readdir } from "node:fs/promises";
fs TraX22-HydraOps-78a04e9/packages/llm/src/index.ts :6 import { readFile as fsReadFile } from 'node:fs/promises';
fs TraX22-HydraOps-78a04e9/tools/build-backend.mjs :21 import fs from "node:fs";
fs TraX22-HydraOps-78a04e9/tools/make-screenshots.mjs :21 import fs from "node:fs";
fs TraX22-HydraOps-78a04e9/tools/serve.mjs :21 import fs from "node:fs";

shell / exec 6

shell TraX22-HydraOps-78a04e9/apps/api/src/index.ts :7 import { spawn } from "node:child_process";
shell TraX22-HydraOps-78a04e9/apps/desktop/src/data-dir.js :17 const { spawn } = require("node:child_process");
shell TraX22-HydraOps-78a04e9/apps/desktop/src/self-update.js :16 const { spawn } = require("node:child_process");
shell TraX22-HydraOps-78a04e9/apps/desktop/src/services.js :18 const { spawn, execFile } = require("node:child_process");
shell TraX22-HydraOps-78a04e9/tools/make-screenshots.mjs :20 import { spawn } from "node:child_process";
shell TraX22-HydraOps-78a04e9/tools/serve.mjs :20 import { spawn } from "node:child_process";

network 19

net TraX22-HydraOps-78a04e9/apps/api/src/index.ts :236 const r = await fetch("https://api.github.com/repos/TraX22/HydraOps/releases/latest", {
net TraX22-HydraOps-78a04e9/apps/desktop/src/services.js :21 const http = require("node:http");
net TraX22-HydraOps-78a04e9/apps/key-proxy/src/index.ts :14 import http from "node:http";
net TraX22-HydraOps-78a04e9/apps/telegram-bot/src/index.ts :123 const res = await fetch(`https://api.telegram.org/bot${token}/${method}`, {
net TraX22-HydraOps-78a04e9/apps/worker-video/src/index.ts :250 const res = await fetch(video.url);
net TraX22-HydraOps-78a04e9/packages/addons/src/guard.ts :19 import net from "node:net";
net TraX22-HydraOps-78a04e9/packages/addons/src/native/brave_search/index.ts :53 const r = await fetch("https://www.cloudflare.com/cdn-cgi/trace", { signal: AbortSignal.timeout(3000) });
net TraX22-HydraOps-78a04e9/packages/addons/src/native/fetch_url/index.ts :1 import net from "node:net";
net TraX22-HydraOps-78a04e9/packages/addons/src/native/github/index.ts :38 const res = await fetch(url, {
net TraX22-HydraOps-78a04e9/packages/addons/src/native/send_to_telegram/index.ts :18 const r = await fetch(`${apiUrl()}/api/telegram/send`, {
net TraX22-HydraOps-78a04e9/packages/addons/src/native/web_search/index.ts :9 const response = await fetch(url, {
net TraX22-HydraOps-78a04e9/packages/addons/src/native/youtube_transcript/index.ts :50 return await fetch(url, { ...init, signal: ctrl.signal });

show 7 more

net TraX22-HydraOps-78a04e9/packages/llm/src/index.ts :285 const response = await fetch(url);
net TraX22-HydraOps-78a04e9/tools/make-screenshots.mjs :62 const r = await fetch(`${BASE}/api/auth/status`, { signal: AbortSignal.timeout(2000) });
net TraX22-HydraOps-78a04e9/ui/src/app/services/agents.service.ts :19 this.fetch();
net TraX22-HydraOps-78a04e9/ui/src/app/views/agents/agents.component.ts :126 this.agentsService.fetch();
net TraX22-HydraOps-78a04e9/ui/src/app/views/chat/chat.component.ts :363 const res = await fetch(url);
net TraX22-HydraOps-78a04e9/ui/src/app/views/cron/cron.component.ts :45 this.fetch();
net TraX22-HydraOps-78a04e9/ui/src/app/views/system/system.component.ts :32 this.fetch();

secrets 7

secrets TraX22-HydraOps-78a04e9/apps/api/src/index.ts :88 const authToken = process.env.HYDRA_AUTH_TOKEN?.trim() || "";
secrets TraX22-HydraOps-78a04e9/apps/telegram-bot/src/index.ts :34 const AUTH_TOKEN = process.env.HYDRA_AUTH_TOKEN || "";
secrets TraX22-HydraOps-78a04e9/packages/llm/src/debug-test.ts :13 apiKey: process.env.GEMINI_API_KEY
secrets (weak) TraX22-HydraOps-78a04e9/packages/llm/src/test.mjs :10 console.log("Testing with env:", process.env.GEMINI_API_KEY ? "key present" : "no key");
secrets (weak) TraX22-HydraOps-78a04e9/packages/llm/src/test.ts :7 const google = createGoogleGenerativeAI({ apiKey: process.env.GEMINI_API_KEY });
secrets TraX22-HydraOps-78a04e9/tools/make-screenshots.mjs :125 delete process.env.HYDRA_AUTH_TOKEN;
secrets TraX22-HydraOps-78a04e9/tools/serve.mjs :140 if (process.env.HYDRA_AUTH_TOKEN?.trim()) {

database 2

db TraX22-HydraOps-78a04e9/packages/db/src/clear.ts :1 import Database from 'better-sqlite3';
db TraX22-HydraOps-78a04e9/packages/db/src/client.ts :2 import Database from "better-sqlite3";

declared dependencies 7

zod@^3.25.0
zod-to-json-schema@^3.25.2
@types/node@^25.5.0
drizzle-orm@^0.45.2
playwright@^1.62.1
tsup@^8.5.0
tsx@^4.21.0