Personal planning app: vision, goals, projects, tasks, and week in one place — with an AI assistant wired in over MCP. Based on the RPM methodology.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport — counts 11 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
add_achievement
-
add_task
-
add_week_item
-
delete_task
-
delete_week_item
-
get_achievements
-
get_tasks
-
get_week_items
-
get_xp
-
update_task
-
update_week_item
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 0ea1f59 · analyzer v33 · 3d ago
skills & prompt files 2
- agent-rules albertbaarsma-horizon-0ea1f59/AGENTS.md
- agent-rules albertbaarsma-horizon-0ea1f59/CLAUDE.md
danger signals1
- over-broad OAuth scope https://mail.google.com/ albertbaarsma-horizon-0ea1f59/app/dashboard/MailTab.tsx :245
href={`https://mail.google.com/mail/u/0/#inbox/${m.id}`}
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 290
filesystem 15
- fs (weak) albertbaarsma-horizon-0ea1f59/__tests__/landing-css-coverage.test.ts :2
import { readFileSync, readdirSync } from 'node:fs' - fs (weak) albertbaarsma-horizon-0ea1f59/__tests__/lib/google-scopes.test.ts :2
import { readFileSync } from 'fs' - fs (weak) albertbaarsma-horizon-0ea1f59/__tests__/nonfunctional/goal-consistency.test.ts :10
import fs from 'fs' - fs albertbaarsma-horizon-0ea1f59/app/api/build/route.ts :9
import fs from 'fs/promises' - fs albertbaarsma-horizon-0ea1f59/lib/tool-executor.ts :5
import fs from 'fs/promises' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/e2e-projectgroepen.mjs :5
import { readFileSync } from 'node:fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/export-projects.mjs :4
import { readFileSync } from 'node:fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/fix-orphan-goal-xp.mjs :3
import fs from 'fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/fix-orphan-week-items.mjs :4
import fs from 'fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/list-projects.mjs :3
import { readFileSync } from 'node:fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/migrate-goal-horizons-2026-09-02.mjs :13
import { readFileSync } from 'node:fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/migrate.mjs :4
import { readFileSync } from 'node:fs'
show 3 more
- fs (weak) albertbaarsma-horizon-0ea1f59/scripts/setup-db.mjs :9
import { readFileSync, readdirSync } from 'node:fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/usage-report.mjs :9
import fs from 'fs' - fs (weak) albertbaarsma-horizon-0ea1f59/scripts/visual-snapshots.mjs :5
import { mkdirSync } from 'node:fs'
shell / exec 5
- shell (weak) albertbaarsma-horizon-0ea1f59/__tests__/api/tool-executor.test.ts :78
const result = await exec('add_week_item', { date: '2026-07-12', text: 'Tandarts 10:00', type: 'task' }) - shell albertbaarsma-horizon-0ea1f59/app/api/build/route.ts :10
import { exec } from 'child_process' - shell albertbaarsma-horizon-0ea1f59/app/api/ollama/route.ts :2
import { spawn } from 'child_process' - shell albertbaarsma-horizon-0ea1f59/lib/tool-executor.ts :6
import { exec } from 'child_process' - shell (weak) albertbaarsma-horizon-0ea1f59/scripts/usage-report.mjs :12
import { execFileSync } from 'child_process'
network 29
- net albertbaarsma-horizon-0ea1f59/app/ai-setup/AiSetupClient.tsx :40
const res = await fetch('/api/ai/xp', { headers: { Authorization: `Bearer ${token}` } }) - net albertbaarsma-horizon-0ea1f59/app/api/achievements/parse/route.ts :50
const res = await fetch(ANTHROPIC_URL, { - net albertbaarsma-horizon-0ea1f59/app/api/ai/suggest-actions/route.ts :31
const res = await fetch(ANTHROPIC_URL, { - net albertbaarsma-horizon-0ea1f59/app/api/calendar/google/route.ts :31
const resp = await fetch(url.toString(), { - net albertbaarsma-horizon-0ea1f59/app/api/chat/route.ts :562
const res = await fetch(completionsUrl, { - net albertbaarsma-horizon-0ea1f59/app/api/diary/mood/route.ts :45
const res = await fetch(ANTHROPIC_URL, { - net albertbaarsma-horizon-0ea1f59/app/api/finance/parse-statement/route.ts :65
const res = await fetch(ANTHROPIC_URL, { - net albertbaarsma-horizon-0ea1f59/app/api/finance/parse-text/route.ts :60
const res = await fetch(ANTHROPIC_URL, { - net albertbaarsma-horizon-0ea1f59/app/api/gmail/debug/route.ts :30
const resp = await fetch('https://gmail.googleapis.com/gmail/v1/users/me/profile', { - net albertbaarsma-horizon-0ea1f59/app/api/gmail/summarize/route.ts :88
const aiResp = await fetch(ANTHROPIC_URL, { - net albertbaarsma-horizon-0ea1f59/app/api/ollama/route.ts :10
const res = await fetch(`${OLLAMA_BASE}/api/tags`, { signal: controller.signal }) - net albertbaarsma-horizon-0ea1f59/app/api/projects/parse/route.ts :34
const res = await fetch(ANTHROPIC_URL, {
show 17 more
- net albertbaarsma-horizon-0ea1f59/app/api/transcribe/route.ts :25
const resp = await fetch('https://api.groq.com/openai/v1/audio/transcriptions', { - net albertbaarsma-horizon-0ea1f59/app/api/youtube/route.ts :18
const chanResp = await fetch( - net albertbaarsma-horizon-0ea1f59/app/chat/ChatClient.tsx :123
fetch('/api/ollama').then(r => r.json()).then(d => { - net albertbaarsma-horizon-0ea1f59/app/dashboard/DashboardClient.tsx :330
fetch('/api/weather').then(r => r.json()).then(d => { - net albertbaarsma-horizon-0ea1f59/app/dashboard/JarvisWidget.tsx :135
fetch('/api/ollama').then(r => r.json()).then(d => { - net albertbaarsma-horizon-0ea1f59/app/dashboard/MailTab.tsx :43
fetch('/api/gmail/summarize') - net albertbaarsma-horizon-0ea1f59/app/dashboard/PlanningSessionModal.tsx :162
const res = await fetch('/api/achievements/parse', { - net albertbaarsma-horizon-0ea1f59/app/dashboard/ProjectsView.tsx :705
const res = await fetch('/api/projects/parse', { - net albertbaarsma-horizon-0ea1f59/app/dashboard/ReportTab.tsx :27
const res = await fetch('/api/reports') - net albertbaarsma-horizon-0ea1f59/app/dashboard/WeekTab.tsx :368
const res = await fetch('/api/ai/suggest-actions', { - net albertbaarsma-horizon-0ea1f59/app/dashboard/YouTubeTab.tsx :97
fetch('/api/youtube') - net albertbaarsma-horizon-0ea1f59/app/finance/FinanceClient.tsx :59
fetch('/api/finance/data').then(r => r.json()).then(d => { - net albertbaarsma-horizon-0ea1f59/app/finance/TextImportPanel.tsx :35
const res = await fetch('/api/finance/parse-text', { - net albertbaarsma-horizon-0ea1f59/app/finance/TransactionsPanel.tsx :53
const res = await fetch('/api/finance/parse-statement', { method: 'POST', body: fd }) - net albertbaarsma-horizon-0ea1f59/lib/google-api.ts :6
const r = await fetch('https://oauth2.googleapis.com/token', { - net albertbaarsma-horizon-0ea1f59/lib/report-generator.ts :128
const res = await fetch(ANTHROPIC_URL, { - net albertbaarsma-horizon-0ea1f59/lib/weather-fetcher.ts :36
fetch('https://data.buienradar.nl/2.0/feed/json', { next: { revalidate: 600 } }),
secrets 13
- secrets albertbaarsma-horizon-0ea1f59/app/api/achievements/parse/route.ts :25
const apiKey = (profile?.ai_api_key as string | null) || process.env.ANTHROPIC_API_KEY - secrets albertbaarsma-horizon-0ea1f59/app/api/ai/suggest-actions/route.ts :28
const apiKey = (profile?.ai_api_key || process.env.ANTHROPIC_API_KEY) as string | undefined - secrets albertbaarsma-horizon-0ea1f59/app/api/chat/route.ts :484
const aiApiKey = (profile?.ai_api_key || process.env.ANTHROPIC_API_KEY) as string | undefined - secrets albertbaarsma-horizon-0ea1f59/app/api/diary/mood/route.ts :29
const apiKey = (profile?.ai_api_key as string | null) || process.env.ANTHROPIC_API_KEY - secrets albertbaarsma-horizon-0ea1f59/app/api/finance/parse-statement/route.ts :31
const apiKey = (profile?.ai_api_key as string | null) || process.env.ANTHROPIC_API_KEY - secrets albertbaarsma-horizon-0ea1f59/app/api/finance/parse-text/route.ts :31
const apiKey = (profile?.ai_api_key as string | null) || process.env.ANTHROPIC_API_KEY - secrets albertbaarsma-horizon-0ea1f59/app/api/gmail/summarize/route.ts :61
const apiKey = profile?.ai_api_key || process.env.ANTHROPIC_API_KEY - secrets albertbaarsma-horizon-0ea1f59/app/api/projects/parse/route.ts :31
const apiKey = (profile?.ai_api_key || process.env.ANTHROPIC_API_KEY) as string | undefined - secrets albertbaarsma-horizon-0ea1f59/app/api/reports/cron/route.ts :11
if (!process.env.CRON_SECRET || authHeader !== `Bearer ${process.env.CRON_SECRET}`) { - secrets albertbaarsma-horizon-0ea1f59/app/api/reports/generate/route.ts :14
const apiKey = (profile?.ai_api_key as string | null) || process.env.ANTHROPIC_API_KEY - secrets albertbaarsma-horizon-0ea1f59/app/api/transcribe/route.ts :17
const apiKey = profile?.ai_token || process.env.GROQ_API_KEY - secrets albertbaarsma-horizon-0ea1f59/lib/ai-api-auth.ts :12
process.env.SUPABASE_SERVICE_ROLE_KEY!,
show 1 more
- secrets albertbaarsma-horizon-0ea1f59/lib/google-api.ts :11
client_secret: process.env.GOOGLE_CLIENT_SECRET!,
database 6
- db (weak) albertbaarsma-horizon-0ea1f59/scripts/fix-orphan-goal-xp.mjs :4
import pg from 'pg' - db (weak) albertbaarsma-horizon-0ea1f59/scripts/fix-orphan-week-items.mjs :5
import pg from 'pg' - db (weak) albertbaarsma-horizon-0ea1f59/scripts/migrate-goal-horizons-2026-09-02.mjs :14
import pg from 'pg' - db (weak) albertbaarsma-horizon-0ea1f59/scripts/migrate.mjs :5
import pg from 'pg' - db (weak) albertbaarsma-horizon-0ea1f59/scripts/setup-db.mjs :11
import pg from 'pg' - db (weak) albertbaarsma-horizon-0ea1f59/scripts/usage-report.mjs :11
import pg from 'pg'
tool registrations 11
- get_tasks albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :23
- add_task albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :30
- update_task albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :42
- delete_task albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :54
- add_achievement albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :62
- get_achievements albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :74
- get_week_items albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :82
- add_week_item albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :92
- update_week_item albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :104
- delete_week_item albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :117
- get_xp albertbaarsma-horizon-0ea1f59/lib/mcp-server.ts :125
declared dependencies 22
- @supabase/ssr@^0.5.2
- @supabase/supabase-js@^2.45.4
- mcp-handler@^2.1.1
- next@^16.3.0
- pg@^8.22.0
- react@^18
- react-dom@^18
- zod@^4.5.4
- @testing-library/jest-dom@^6.9.1
- @testing-library/react@^16.3.2
- @types/node@^20
- @types/pg@^8.20.0
show 10 more
- @types/react@^18
- @types/react-dom@^18
- @vitejs/plugin-react@^6.0.3
- autoprefixer@^10.0.1
- jsdom@^29.1.1
- playwright-core@^1.61.1
- postcss@^8
- tailwindcss@^3.4.1
- typescript@^5
- vitest@^4.1.9
clipboard 1
- navigator.clipboard albertbaarsma-horizon-0ea1f59/vitest.setup.ts :7
if (typeof navigator !== 'undefined' && !navigator.clipboard) {
obfuscation 1
- dynamic require()/import() albertbaarsma-horizon-0ea1f59/scripts/usage-report.mjs :41
const { buildReport, reportAsText } = await import(`file:///${tmp.replace(/\\/g, '/')}`)