Shared libraries behind the agentwares portfolio: @agentwares/mcp-kit (MCP servers over stdio and Streamable HTTP), @agentwares/notify (email, Slack, Discord, signed webhooks), @agentwares/x402 (402 Payment Required) and @agentwares/web-bot-auth (Ed25519 request signing for Cloudflare's Verified Bots).
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 820e943 · analyzer v33 · 1d ago
danger signals2
- suspicious endpoint discord.com agentwares-libs-820e943/packages/notify/src/channels.test.ts :194
"https://discord.com/api/webhooks/1/abc", - suspicious endpoint discord.com agentwares-libs-820e943/packages/notify/src/notify.test.ts :68
discord: "https://discord.com/api/webhooks/1/abc",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 67
filesystem 2
- fs (weak) agentwares-libs-820e943/packages/web-bot-auth/scripts/generate-signing-key.mjs :24
import { chmodSync, existsSync, statSync, writeFileSync } from "node:fs"; - fs agentwares-libs-820e943/vitest.setup.ts :3
import { existsSync } from "node:fs";
shell / exec 1
- shell (weak) agentwares-libs-820e943/packages/mcp-kit/scripts/conformance.mjs :12
import { spawn, spawnSync } from "node:child_process";
network 4
- net (weak) agentwares-libs-820e943/packages/mcp-kit/scripts/conformance.mjs :13
import { createServer } from "node:net"; - net (weak) agentwares-libs-820e943/packages/mcp-kit/src/http.test.ts :82
const unknown = await fetch(server.url, { - net agentwares-libs-820e943/packages/notify/src/channels.ts :46
return typeof fetch === "function" ? (input, init) => fetch(input, init) : undefined; - net (weak) agentwares-libs-820e943/packages/notify/src/notify.test.ts :221
return h.fetch(input, init);
secrets 1
- secrets (weak) agentwares-libs-820e943/packages/notify/src/live.test.ts :15
const apiKey = process.env["RESEND_API_KEY"];
declared dependencies 8
- @eslint/js@^10.0.1
- @types/node@^26.4.1
- eslint@^10.9.1
- prettier@^3.9.6
- tsup@^8.5.1
- typescript@^5.9.3
- typescript-eslint@^8.69.0
- vitest@^4.1.11