MCP Observatory
3m ago Tracked 59,469 Last 3m ago 24h 2,464
github TypeScript re-analysis due

buildinternet/uploads

github

Lightweight upload host and tool for coding agents to add files to pull requests. Cloud and self-host options.

maintainer
buildinternet
licence
Apache-2.0
first seen
2026-07-08
last seen
2026-09-17
releases · 30d
19
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit bb8ac7d · analyzer v33 · 1d ago

skills & prompt files 10

danger signals4

code evidence vuploads-v0.55.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 931

filesystem 73

  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/run-timed.mjs :20 import { existsSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/src/file-metadata-facets.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/src/github-comment-render.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/src/openapi-contract.test.ts :25 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/src/poster-probe.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/src/routes/me.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/test/content-hash-vocab-parity.test.ts :23 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/test/helpers/sqlite-d1.ts :10 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/test/routes-galleries.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/api/test/routes-workspace-galleries.test.ts :13 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/auth/src/test/fake-d1.ts :33 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/web/astro.config.mjs :1 import { createReadStream } from "node:fs";
show 28 more
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/web/src/legal-consent.test.ts :17 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/web/src/lib/changelog-ui.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/web/src/lib/client-router-boot.test.ts :8 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/apps/web/src/lib/signed-in-page.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/packages/comment-config/src/index.test.ts :1 import { readFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/ui/tsup.config.ts :1 import { copyFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/bin/dist-staleness.mjs :16 import { existsSync, readdirSync, statSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/packages/uploads/scripts/check-pack.mjs :3 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/packages/uploads/scripts/inline-shared.mjs :10 import { readFileSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/annotate/text.ts :10 import { readFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/commands.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/annotate.ts :1 import { readFileSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/config.ts :1 import { existsSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/screenshot.ts :1 import { readFileSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/update.ts :1 import { realpathSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/comment-config.ts :9 import fs from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/config-file.ts :1 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/config.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/frame.ts :11 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/hooks-install.ts :12 import fs from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/report.ts :10 import { readFileSync, statSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/screenshot-local.ts :11 import { existsSync, readdirSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/screenshot.ts :11 import { existsSync, readFileSync, statSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/session-cli-version.ts :7 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/sidecar.ts :22 import { existsSync, readFileSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/telemetry.ts :12 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
  • fs buildinternet-uploads-bb8ac7d/packages/uploads/src/update-check.ts :8 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs (weak) buildinternet-uploads-bb8ac7d/packages/uploads/test/annotate-render.test.ts :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

33 more not shown — this panel samples each group; the count above is the real total.

shell / exec 16

  • shell (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/run-timed.mjs :19 import { spawn, spawnSync } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/apps/auth/src/test/fake-d1.ts :178 async exec(sql: string) {
  • shell (weak) buildinternet-uploads-bb8ac7d/apps/web/scripts/preview-supervisor.mjs :18 import { spawn } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/packages/uploads/scripts/check-pack.mjs :2 import { execFileSync } from "node:child_process";
  • shell buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/hook.ts :13 import { execFileSync } from "node:child_process";
  • shell buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/login.ts :3 import { spawn } from "node:child_process";
  • shell buildinternet-uploads-bb8ac7d/packages/uploads/src/github-gh.ts :1 import { execFileSync } from "node:child_process";
  • shell buildinternet-uploads-bb8ac7d/packages/uploads/src/keys.ts :1 import { execSync } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/packages/uploads/test/cli-completion.test.ts :1 import { spawnSync } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/packages/uploads/test/hooks-install.test.ts :1 import { spawnSync } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/packages/uploads/test/inline-shared.test.ts :1 import { execFileSync } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/scripts/auth-d1-data-move.mjs :53 import { spawnSync } from "node:child_process";
show 4 more
  • shell (weak) buildinternet-uploads-bb8ac7d/scripts/build-mcp-server-card.mjs :10 import { execFileSync } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/scripts/cf-error-pages/deploy.mjs :36 import { execFile } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/scripts/dev-stack-common.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) buildinternet-uploads-bb8ac7d/scripts/dev-stack.mjs :7 import { spawn, spawnSync } from "node:child_process";

network 58

  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/backfill-orgs.mjs :28 const res = await fetch(`${api}/admin/orgs/backfill`, {
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/reencrypt-workspace-secrets.mjs :25 const res = await fetch(url, {
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/src/github-ingest.test.ts :530 it("transient asset fetch (503) throws instead of skipping", async () => {
  • net buildinternet-uploads-bb8ac7d/apps/api/src/metrics-overview.ts :104 const res = await env.AUTH.fetch(`https://auth.internal/internal/metrics?since=${since}`, {
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/src/org-workspaces.test.ts :16 /** Stub matching the Fetcher interface's `.fetch()` shape used by env.AUTH. */
  • net buildinternet-uploads-bb8ac7d/apps/api/src/org-workspaces.ts :94 response = await env.AUTH.fetch(url.toString(), {
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/src/routes/admin-promote.test.ts :20 /** Stub matching the Fetcher interface's `.fetch()` shape used by env.AUTH. */
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/admin-ui.ts :118 response = await env.AUTH.fetch(`https://auth.internal${path}`, {
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/admin.ts :133 // fetch(), so there is nothing to strip here.
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/auth.ts :111 c.env.AUTH.fetch("https://auth.internal/internal/join", {
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/galleries.ts :59 * shared handler reference rather than a `.fetch()` re-dispatch (galleries
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/me.ts :55 // `c.executionCtx` throws outside a real Workers/`app.fetch(req, env, ctx)`
show 28 more
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/workspace-files.ts :496 // This router is `.fetch()`-ed directly (not only mounted via `.route()`)
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/workspace-galleries.ts :11 * established for files via a `.fetch()` re-dispatch. Galleries doesn't use
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/workspace-github.ts :391 // `.fetch()`-ed directly by `routes/me.ts`'s `forwardToWorkspaceGithub`
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/workspace-members.ts :7 * own auth, own `.onError()`, `.fetch()`-able directly by an alias with no
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/workspace-settings.ts :9 * own `.onError()`, `.fetch()`-able directly by an alias with no
  • net buildinternet-uploads-bb8ac7d/apps/api/src/routes/workspaces.ts :453 const response = await c.env.AUTH.fetch("https://auth.internal/internal/invite", {
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/src/session-auth.test.ts :12 /** Stub matching the Fetcher interface's `.fetch()` shape used by env.AUTH. */
  • net buildinternet-uploads-bb8ac7d/apps/api/src/session-auth.ts :46 // Host is unused for routing on a direct service-binding fetch() call — it
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/src/storage-verify.test.ts :479 it("reports a thrown fetch (DNS/timeout/subrequest failure) as 'couldn't verify from here', not 'domain is broken'", async () => {
  • net buildinternet-uploads-bb8ac7d/apps/api/src/storage-verify.ts :239 * browsers and `fetch()` will still resolve as part of an IP literal even
  • net buildinternet-uploads-bb8ac7d/apps/api/src/usage-alert-sweep.ts :101 const res = await env.AUTH.fetch(`${INTERNAL_ORIGIN}/internal/usage-alerts/notify`, {
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/test/backfill-gh-metadata.test.ts :157 it("counts a thrown PATCH fetch (transport error) as an error and continues", async () => {
  • net (weak) buildinternet-uploads-bb8ac7d/apps/api/test/dual-workspace-auth-preset.test.ts :78 const res = await workspaceGithub.fetch(request, env);
  • net buildinternet-uploads-bb8ac7d/apps/auth/src/billing-bridge.ts :64 const response = await env.API.fetch("https://internal/internal/billing/plan", {
  • net buildinternet-uploads-bb8ac7d/apps/auth/src/billing-outbox.ts :247 const response = await env.API.fetch("https://internal/internal/billing/plan", {
  • net buildinternet-uploads-bb8ac7d/apps/auth/src/cimd-transport.ts :296 const res = await fetch(request);
  • net (weak) buildinternet-uploads-bb8ac7d/apps/auth/src/internal-routes.test.ts :1810 // between them. Simulated here by making the cap-lookup fetch (which runs
  • net buildinternet-uploads-bb8ac7d/apps/auth/src/internal.ts :7 * `fetch()` call never traverses the Cloudflare edge, so `cf-connecting-ip`
  • net buildinternet-uploads-bb8ac7d/apps/auth/src/member-cap.ts :66 response = await env.API.fetch(url, {
  • net buildinternet-uploads-bb8ac7d/apps/mcp/src/index.ts :229 return await handler.fetch(c.req.raw);
  • net buildinternet-uploads-bb8ac7d/apps/mcp/src/oauth.ts :42 const res = await fetch(jwksUrl);
  • net (weak) buildinternet-uploads-bb8ac7d/apps/mcp/test/mcp.test.ts :49 * through, so stubbing global fetch (the thing src/oauth.ts's default
  • net (weak) buildinternet-uploads-bb8ac7d/apps/web/scripts/preview-supervisor.mjs :74 const res = await fetch(previewUrl, {
  • net buildinternet-uploads-bb8ac7d/apps/web/src/entry.ts :12 async fetch(request, env, ctx) {
  • net buildinternet-uploads-bb8ac7d/apps/web/src/lib/admin-api.ts :78 const res = await fetch(url, { credentials: "include", cache: "no-store" });
  • net (weak) buildinternet-uploads-bb8ac7d/apps/web/src/lib/api-proxy.test.ts :229 it("adapts serverApiFetch to a fetch(input, init) shape for api-client's fetchImpl", async () => {
  • net buildinternet-uploads-bb8ac7d/apps/web/src/lib/api-proxy.ts :29 API?: { fetch(req: Request): Promise<Response> };
  • net buildinternet-uploads-bb8ac7d/apps/web/src/lib/auth-client.ts :4 * Decision: plain `fetch()` wrappers against the auth worker's REST

18 more not shown — this panel samples each group; the count above is the real total.

secrets 16

  • secrets (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/add-workspace.mjs :171 secretAccessKey: opts["secret-access-key"] ?? process.env.R2_SECRET_ACCESS_KEY,
  • secrets (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/backfill-gh-metadata.mjs :177 const token = process.env.UPLOADS_TOKEN;
  • secrets (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/backfill-orgs.mjs :21 const token = process.env.ADMIN_TOKEN ?? process.env.UPLOADS_ADMIN_TOKEN ?? "";
  • secrets (weak) buildinternet-uploads-bb8ac7d/apps/api/scripts/reencrypt-workspace-secrets.mjs :17 const token = process.env.ADMIN_TOKEN ?? process.env.UPLOADS_ADMIN_TOKEN ?? "";
  • secrets buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/admin-enrollment.ts :88 process.env.ADMIN_TOKEN ??
  • secrets buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/login.ts :500 if (process.env.UPLOADS_TOKEN && !force)
  • secrets buildinternet-uploads-bb8ac7d/packages/uploads/src/commands/session.ts :163 const envTokenStillSet = Boolean(process.env.UPLOADS_TOKEN);
  • secrets buildinternet-uploads-bb8ac7d/packages/uploads/src/config.ts :136 const token = flags?.token ?? process.env.UPLOADS_TOKEN ?? fromEnvFile.token ?? fromUser.token;
  • secrets (weak) buildinternet-uploads-bb8ac7d/packages/uploads/test/commands-login.test.ts :830 process.env.ADMIN_TOKEN = "admin-secret";
  • secrets (weak) buildinternet-uploads-bb8ac7d/packages/uploads/test/commands-session.test.ts :10 delete process.env.UPLOADS_TOKEN;
  • secrets (weak) buildinternet-uploads-bb8ac7d/scripts/attachment-index-shadow-report.mjs :23 const token = process.env.CLOUDFLARE_API_TOKEN;
  • secrets (weak) buildinternet-uploads-bb8ac7d/scripts/backfill-posters.mjs :262 const token = process.env.UPLOADS_TOKEN;
show 4 more
  • secrets (weak) buildinternet-uploads-bb8ac7d/scripts/cf-error-pages/deploy.mjs :60 const token = process.env.CLOUDFLARE_API_TOKEN;
  • secrets (weak) buildinternet-uploads-bb8ac7d/scripts/smoke-contract.mjs :9 const token = process.env.UPLOADS_TOKEN;
  • secrets (weak) buildinternet-uploads-bb8ac7d/scripts/smoke-remote-mcp.mjs :11 const adminToken = process.env.ADMIN_TOKEN;
  • secrets (weak) buildinternet-uploads-bb8ac7d/scripts/stripe/reconcile-plans.mjs :30 const apiKey = process.env.STRIPE_LIVE_OPERATOR_KEY;

install hooks 2

  • prepare buildinternet-uploads-bb8ac7d/package.json :59 husky
  • prepublishOnly buildinternet-uploads-bb8ac7d/packages/uploads/package.json :43 npm run build

declared dependencies 13

  • @buildinternet/uploads@workspace:*
  • @changesets/cli@^2.31.0
  • @manypkg/get-packages@1.1.3
  • husky@^9.1.7
  • lint-staged@^17.0.8
  • oxfmt@^0.57.0
  • oxlint@^1.72.0
  • oxlint-tsgolint@^0.24.0
  • portless@^0.15.4
  • prettier@^3.9.6
  • prettier-plugin-astro@^0.14.1
  • typescript@^7.0.2
show 1 more
  • vitest@^4.1.10

cursor-plugin 2

  • opaque (low) buildinternet-uploads-bb8ac7d/.cursor/environment.json bundled .cursor/ plugin descriptor (buildinternet-uploads-bb8ac7d/.cursor/environment.json) — presence-detected; review the descriptor
  • opaque (low) buildinternet-uploads-bb8ac7d/.cursor/install.sh bundled .cursor/ plugin descriptor (buildinternet-uploads-bb8ac7d/.cursor/install.sh) — presence-detected; review the descriptor