MCP Observatory
48s ago Tracked 55,861 Last 48s ago 24h 2,736
github TypeScript analyzed 7e1c6ad

aeonfun/aeon

github

The most autonomous AI agent framework: runs unattended on GitHub Actions, self-healing skills, drives Claude Code, Grok, Codex & more. No approval loops. Configure once, forget forever.

maintainer
aeonfun
licence
MIT
first seen
2026-08-17
last seen
2026-09-10
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  2. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  3. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  4. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  5. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  6. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  7. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  8. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  9. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  10. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  11. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  12. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  13. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  14. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  15. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  16. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  17. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  18. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  19. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
  20. HIGH code analysis flagged hidden prompt content ×2, committed secret in aeonfun/aeon
capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 7e1c6ad · analyzer v33 · 6h ago

skills & prompt files 42

danger signals8

code evidence vv0.1.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 280

filesystem 22

  • fs (weak) aeonfun-aeon-7e1c6ad/.claude/skills/aeon/scripts/mine-history.mjs :25 import fs from 'node:fs';
  • fs (weak) aeonfun-aeon-7e1c6ad/.github/scripts/iron-config.mjs :10 import { readFileSync } from "node:fs";
  • fs (weak) aeonfun-aeon-7e1c6ad/.github/scripts/iron-report.mjs :10 import { readFileSync } from "node:fs";
  • fs aeonfun-aeon-7e1c6ad/apps/cli/src/commands/secrets.ts :1 import { readFileSync } from 'node:fs'
  • fs aeonfun-aeon-7e1c6ad/apps/cli/src/commands/strategy.ts :2 import { readFileSync } from 'node:fs'
  • fs aeonfun-aeon-7e1c6ad/apps/dashboard/app/api/analytics/route.ts :4 import { readFileSync } from 'fs'
  • fs aeonfun-aeon-7e1c6ad/apps/dashboard/app/api/grok-auth/route.ts :3 import { existsSync } from 'fs'
  • fs aeonfun-aeon-7e1c6ad/apps/dashboard/app/api/outputs/route.ts :2 import { readdir, readFile } from 'fs/promises'
  • fs aeonfun-aeon-7e1c6ad/apps/dashboard/lib/github.ts :1 import { readFile, writeFile, readdir, mkdir, rm } from 'fs/promises'
  • fs aeonfun-aeon-7e1c6ad/apps/dashboard/lib/harness-auth-server.ts :2 import { existsSync } from 'fs'
  • fs aeonfun-aeon-7e1c6ad/apps/dashboard/lib/memory.ts :1 import { readdir, readFile, stat } from 'fs/promises'
  • fs aeonfun-aeon-7e1c6ad/apps/mcp-server/src/skill-executor.ts :11 import { readFileSync, existsSync } from "fs";
show 10 more
  • fs (weak) aeonfun-aeon-7e1c6ad/plugin/skills/aeon/scripts/mine-history.mjs :26 import fs from 'node:fs';
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/competitor-monitor.mjs :29 import { readFileSync, writeFileSync } from 'node:fs'
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/fleet-scorecard.mjs :17 import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/gen-agents-md.js :33 const fs = require('fs')
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/skill-health-routing.mjs :13 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/tests/test_fleet_scorecard.mjs :3 import { readFileSync } from 'node:fs'
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/validate-config.js :38 const fs = require('fs');
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/validate-config.test.js :14 const fs = require('fs');
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/validate-readme-catalog.mjs :47 import { readFileSync, existsSync } from 'node:fs'
  • fs (weak) aeonfun-aeon-7e1c6ad/scripts/validate-skill-packs.mjs :46 import { readFileSync, existsSync } from 'node:fs'

shell / exec 19

  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/app/api/analytics/route.ts :2 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/app/api/grok-auth/route.ts :2 import { spawn, execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/app/api/observability/route.ts :2 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/app/api/outputs/route.ts :4 import { execSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/auth.ts :1 import { execFileSync, execSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/builders.ts :1 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/dispatch.ts :25 * `execFileSync('gh', [...])` (argv array, no shell), so this is defense-in-depth
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/gh.ts :1 import { execSync, execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/github-auth.ts :1 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/github.ts :2 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/harness-auth-server.ts :1 import { execFileSync, spawn, type ChildProcess } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/open-browser.ts :6 import { execFile } from 'child_process'
show 7 more
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/run-skill.ts :1 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/runs.ts :1 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/secrets-catalog.ts :1 import { execFileSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/skills.ts :1 import { execSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/dashboard/lib/sync.ts :1 import { execSync } from 'child_process'
  • shell aeonfun-aeon-7e1c6ad/apps/mcp-server/src/skill-executor.ts :13 import { spawn, spawnSync } from "child_process";
  • shell aeonfun-aeon-7e1c6ad/skills/rightstack/run.mjs :3 import { spawnSync } from "node:child_process";

network 20

  • net aeonfun-aeon-7e1c6ad/apps/dashboard/app/page.tsx :115 try { const [sr, rr, secr] = await Promise.all([fetch('/api/skills'), fetch('/api/runs'), fetch('/api/secrets')]); if (sr.ok) { const d = await sr.json() as SkillsResponse; setSkills(d.skills); if (d.
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/components/InstantModeCard.tsx :56 const res = await fetch(`https://api.telegram.org/bot${botToken.trim()}/setWebhook?url=${encodeURIComponent(fullWorkerUrl)}`)
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/components/LangfuseRegionCard.tsx :32 fetch('/api/observability')
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/components/McpPanel.tsx :158 const res = await fetch('/api/mcp-auth', {
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/components/RightPanel.tsx :55 try { const r = await fetch(`/api/runs/${run.id}/logs`); if (r.ok) { const d = await r.json() as RunLogs; setRunSummary(d.summary || ''); setRunLogs(d.logs || '') } } catch { setRunLogs('Failed') } fi
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/components/SoulPanel.tsx :48 useEffect(() => { fetch('/api/soul/examples').then(r => r.ok ? r.json() as Promise<SoulExamplesResponse> : { examples: [] }).then(d => setExamples(d.examples || [])).catch(() => {}) }, [])
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/components/TelegramChatIdHelper.tsx :41 const res = await fetch(getUpdatesUrl)
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/components/TelegramCommandsCard.tsx :27 const res = await fetch('/api/telegram/commands', { method: 'POST' })
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/lib/api-client.ts :19 const res = await fetch(url, init)
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/lib/github.ts :100 return fetch(`${GITHUB_API}/repos/${repo}/contents/${path}`, {
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/lib/mcp-oauth.ts :60 const res = await fetch(url, { ...init, headers: { Accept: 'application/json', ...(init?.headers ?? {}) } })
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/lib/security/api-gate.ts :29 * `fetch("http://localhost:5555/api/skills/foo/run", { method: "POST",
show 8 more
  • net aeonfun-aeon-7e1c6ad/apps/dashboard/lib/sync.ts :11 // GET /api/sync and `aeon sync --status`. A failed fetch (offline/no remote) leaves
  • net aeonfun-aeon-7e1c6ad/apps/webhook/src/worker.js :38 async fetch(request, env, ctx) {
  • net (weak) aeonfun-aeon-7e1c6ad/apps/webhook/test/replay-guard.test.mjs :33 // --- stub the outbound fetch() the Worker uses for both the GitHub dispatch
  • net (weak) aeonfun-aeon-7e1c6ad/scripts/competitor-monitor.mjs :25 // Exit 0 on success. `snapshot` exits 1 only if EVERY url failed to fetch (one dead
  • net (weak) aeonfun-aeon-7e1c6ad/scripts/fleet-scorecard.mjs :31 return fetch(`https://api.github.com/${path}`, { headers });
  • net (weak) aeonfun-aeon-7e1c6ad/scripts/seo-audit.mjs :423 return fetch(url, {
  • net aeonfun-aeon-7e1c6ad/skills/compute-resell/bootstrap-siwe.mjs :40 const chalRes = await fetch(`${HOST}/v1/seller/auth/challenge?address=${address}`, {
  • net (weak) aeonfun-aeon-7e1c6ad/skills/taskmarket-delegate/scripts/taskmarket.js :24 const res = await fetch(`${BASE}/api/tasks?limit=100`);

secrets 5

  • secrets aeonfun-aeon-7e1c6ad/apps/dashboard/lib/github.ts :18 return !process.env.GITHUB_TOKEN || !process.env.GITHUB_REPO
  • secrets (weak) aeonfun-aeon-7e1c6ad/scripts/fleet-scorecard.mjs :19 const TOKEN = process.env.GH_READ_PAT || process.env.GH_GLOBAL || process.env.GH_TOKEN || process.env.GITHUB_TOKEN || '';
  • secrets (weak) aeonfun-aeon-7e1c6ad/scripts/seo-audit.mjs :966 const pagespeedKey = process.env.PAGESPEED_API_KEY || null
  • secrets aeonfun-aeon-7e1c6ad/skills/compute-resell/bootstrap-siwe.mjs :27 const pk = process.env.SELLER_WALLET_PRIVATE_KEY;
  • secrets (weak) aeonfun-aeon-7e1c6ad/skills/taskmarket-delegate/scripts/taskmarket.js :42 if (!process.env.TASKMARKET_API_KEY) exit(3, 'TASKMARKET_API_KEY not set; write actions require it');

obfuscation 1

  • dynamic require()/import() aeonfun-aeon-7e1c6ad/scripts/tests/test_fleet_scorecard.mjs :34 await import(new URL(`../fleet-scorecard.mjs?test=${Date.now()}`, import.meta.url))

perm:untrusted 1

  • untrusted aeonfun-aeon-7e1c6ad/apps/dashboard/lib/api-client.ts :29 return fetch(url).then(r => r.ok ? r.json() as Promise<T> : Promise.reject(new Error(`HTTP ${r.status}`)))