Self-hosted engineering memory for coding agents with CLI, MCP, proof gates and benchmark artifacts.
C elevated
- capability exposure inferred + 35
- tool safety inferred + 12
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
- C · 35 → C · 47
- A · 0 → C · 35
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: Slack token
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit ad1e26b · analyzer v33 · 2w ago
skills & prompt files 4
danger signals12
- suspicious endpoint app.posthog.com (telemetry) cognilabz-cognibrain-ad1e26b/bin/lib/catalogs.mjs :237
{ name: "baseUrl", label: "PostHog base URL", env: "MEMORY_POSTHOG_BASE_URL", default: "https://app.posthog.com" }, - suspicious endpoint docs.sentry.io (telemetry) cognilabz-cognibrain-ad1e26b/src/api/service/marketplace.ts :138
"project:read", "org:read"], "sentry", "https://docs.sentry.io/api/events/list-a-projects-issues/", ["MEMORY_SENTRY_ORG", "MEMORY_SENTRY_PROJECT", "MEMORY_SENTRY_TOKEN"]), - suspicious endpoint docs.datadoghq.com (telemetry) cognilabz-cognibrain-ad1e26b/src/api/service/marketplace.ts :139
ts_read", "incident_read"], "datadog", "https://docs.datadoghq.com/api/latest/monitors/", ["MEMORY_DATADOG_SITE", "MEMORY_DATADOG_API_KEY", "MEMORY_DATADOG_APP_KEY"]), - suspicious endpoint posthog.com (telemetry) cognilabz-cognibrain-ad1e26b/src/api/service/marketplace.ts :141
gs:read", "insights:read"], "posthog", "https://posthog.com/docs/api/feature-flags", ["MEMORY_POSTHOG_PROJECT", "MEMORY_POSTHOG_TOKEN"]) - suspicious endpoint sentry.io (telemetry) cognilabz-cognibrain-ad1e26b/src/connectors/vendor/providers/observability.ts :14
const url = apiUrl(process.env.MEMORY_SENTRY_API_BASE ?? "https://sentry.io", `/api/0/projects/${org}/${project}/issues/`, { - suspicious endpoint app.posthog.com (telemetry) cognilabz-cognibrain-ad1e26b/src/connectors/vendor/providers/observability.ts :108
process.env.MEMORY_POSTHOG_BASE_URL ?? "https://app.posthog.com", `/api/projects/${encodeURIComponent(project)}/feature_flags/`, { limit: process.env.MEMORY_VENDOR_PAGE_SIZE ?? "20" }), bearerHeaders( - suspicious endpoint docs.sentry.io (telemetry) cognilabz-cognibrain-ad1e26b/src/eval/vendorApiSpecs.ts :154
spec("sentry", "https://docs.sentry.io/api/", "Bearer token", [ - suspicious endpoint docs.datadoghq.com (telemetry) cognilabz-cognibrain-ad1e26b/src/eval/vendorApiSpecs.ts :158
spec("datadog", "https://docs.datadoghq.com/api/latest/", "DD-API-KEY plus DD-APPLICATION-KEY", [ - suspicious endpoint posthog.com (telemetry) cognilabz-cognibrain-ad1e26b/src/eval/vendorApiSpecs.ts :166
spec("posthog", "https://posthog.com/docs/api", "Bearer personal API key", [ - suspicious endpoint sentry.io (telemetry) cognilabz-cognibrain-ad1e26b/src/eval/vendorConnectorsLive.ts :388
nresolved", level: "error", permalink: "https://sentry.io/issues/sentry123", lastSeen: "2026-05-25T09:10:00.000Z", count: "12", userCount: 3 }]); - suspicious endpoint app.datadoghq.com (telemetry) cognilabz-cognibrain-ad1e26b/src/eval/vendorConnectorsLive.ts :390
lert", query: "avg(last_5m):...", url: "https://app.datadoghq.com/monitors/123", tags: ["service:cognibrain"] }]); - committed secret Slack token cognilabz-cognibrain-ad1e26b/docs/operations/security.md :93
xoxb-a…(18 chars, redacted)
[](https://mcpobservatory.com/servers/github:cognilabz/cognibrain/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of cognilabz.