github TypeScript analyzed f5d5f1b unconfirmed MCP

bigduu/Lotus

github

The living interface for AI agents — a React + Vite UI that streams an agent's reasoning, tool calls, and to-do list live over SSE, turning a black-box AI into a transparent teammate you can watch and interrupt.

maintainer
bigduu
license
first seen
2026-06-15
last seen
2026-08-14
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in bigduu/Lotus
  2. HIGH code analysis flagged committed secret in bigduu/Lotus
  3. HIGH code analysis flagged committed secret in bigduu/Lotus
  4. HIGH code analysis flagged committed secret in bigduu/Lotus
  5. HIGH code analysis flagged committed secret in bigduu/Lotus
  6. HIGH code analysis flagged committed secret in bigduu/Lotus
  7. HIGH code analysis flagged committed secret in bigduu/Lotus
  8. HIGH code analysis flagged committed secret in bigduu/Lotus
  9. HIGH code analysis flagged committed secret in bigduu/Lotus
  10. HIGH code analysis flagged committed secret in bigduu/Lotus
  11. HIGH code analysis flagged committed secret in bigduu/Lotus
capabilities 0 tools
transport counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f5d5f1b · analyzer v32 · 1h ago

skills & prompt files 1

danger signals1

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 750

filesystem 5

  • fs (weak) bigduu-Lotus-f5d5f1b/e2e/tests/settings-live-config.spec.ts :2 import { promises as fs } from "node:fs";
  • fs (weak) bigduu-Lotus-f5d5f1b/e2e/utils/project-first-helpers.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) bigduu-Lotus-f5d5f1b/scripts/copy-sidecar.js :3 import fs from 'fs';
  • fs (weak) bigduu-Lotus-f5d5f1b/scripts/rebrand.cjs :8 const fs = require("fs");
  • fs (weak) bigduu-Lotus-f5d5f1b/src/shared/i18n/__tests__/keyCoverage.test.ts :1 import { readFileSync, readdirSync, statSync } from "node:fs";

shell / exec 1

  • shell bigduu-Lotus-f5d5f1b/src/services/common/ServiceFactory.ts :148 /** One-shot exec (default) or long-lived app-server approval relay. */

network 8

  • net (weak) bigduu-Lotus-f5d5f1b/e2e/tests/project-first-workflows.spec.ts :830 const response = await route.fetch();
  • net (weak) bigduu-Lotus-f5d5f1b/e2e/tests/workflows.spec.ts :51 const response = await route.fetch();
  • net bigduu-Lotus-f5d5f1b/src/pages/ChatPage/services/recentWorkspacesApi.ts :8 const response = await fetch(`${baseUrl}/recent`, {
  • net bigduu-Lotus-f5d5f1b/src/pages/ChatPage/services/workspaceApiHelpers.ts :76 const response = await fetch(url, {
  • net (weak) bigduu-Lotus-f5d5f1b/src/services/api/client.test.ts :5 /** Mirrors the DOMException fetch() throws when a request's signal aborts. */
  • net bigduu-Lotus-f5d5f1b/src/services/api/client.ts :233 const response = await fetch(url, options);
  • net bigduu-Lotus-f5d5f1b/src/services/common/ServiceFactory.ts :37 const response = await fetch(buildV2Url(path), {
  • net bigduu-Lotus-f5d5f1b/src/shared/utils/backendBaseUrl.ts :160 const response = await fetch(healthUrl, {

install hooks 2

  • prepack bigduu-Lotus-f5d5f1b/package.json :45 npm run build
  • prepare bigduu-Lotus-f5d5f1b/package.json :47 husky

declared dependencies 52

  • @ant-design/icons@^6.0.0
  • @msgpack/msgpack@^3.1.3
  • @tanstack/react-virtual@^3.13.12
  • @tauri-apps/plugin-dialog@~2
  • @tauri-apps/plugin-fs@~2
  • antd@^5.24.7
  • date-fns@^4.1.0
  • dexie@^4.4.2
  • dompurify@^3.2.4
  • html2canvas@^1.4.1
  • i18next@^25.8.18
  • jotai@^2.20.0
  • jotai-family@^1.0.2
  • jspdf@^4.1.0
  • mermaid@^11.15.0
  • openai@^5.10.2
  • react@^18.3.1
  • react-dom@^18.3.1
  • react-i18next@^16.5.8
  • react-markdown@^10.1.0
  • react-syntax-highlighter@^16.1.0
  • react-zoom-pan-pinch@^3.7.0
  • recharts@^2.15.4
  • rehype-sanitize@^6.0.0
  • remark-breaks@^4.0.0
  • remark-gfm@^4.0.1
  • uuid@^14.0.0
  • zustand@^5.0.6
  • @testing-library/dom@^10.4.1
  • @testing-library/jest-dom@^6.9.1
  • @testing-library/react@^16.3.0
  • @types/node@^25.9.1
  • @types/react@^18.3.1
  • @types/react-dom@^18.3.1
  • @types/react-syntax-highlighter@^15.5.13
  • @types/uuid@^10.0.0
  • @typescript-eslint/eslint-plugin@^8.57.2
  • @typescript-eslint/parser@^8.57.2
  • @vitejs/plugin-react@^4.3.4
  • @vitest/coverage-v8@^4.0.18
  • eslint@^9.39.4
  • eslint-plugin-react-hooks@^7.0.1
  • eslint-plugin-react-refresh@^0.5.2
  • fake-indexeddb@^6.2.5
  • husky@^9.1.7
  • jsdom@^27.1.0
  • lint-staged@^16.4.0
  • prettier@^3.6.2
  • rollup-plugin-visualizer@^7.0.1
  • typescript@~5.6.2
  • vite@^6.0.3
  • vitest@^4.0.18