MCP Observatory
3m ago Tracked 59,449 Last 3m ago 24h 2,443
github TypeScript analyzed 641d4af

comisai/comis

github

Open-source security-first runtime for AI agents that learn and act across sessions.

maintainer
comisai
licence
Apache-2.0
first seen
2026-06-04
last seen
2026-08-26
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 641d4af · analyzer v33 · 2d ago

skills & prompt files 38

danger signals73

code evidence vv1.0.63 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 6021

filesystem 400

  • fs (weak) comisai-comis-641d4af/.github/scripts/prepare-capability-service-fixture.mjs :6 import { existsSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/.github/scripts/stage-capability-protocol-release.mjs :4 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/.github/scripts/verify-release-tag.mjs :3 import { existsSync, readdirSync, readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/__tests__/architecture.test.ts :44 import { readFileSync, readdirSync, existsSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/__tests__/fixtures/phase-8-skill-variants/fixture.test.ts :14 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/__tests__/fixtures/tool-first-replay/fixture.test.ts :13 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/background/auto-background-middleware.test.ts :3 import { mkdirSync, rmSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/background/background-recovery-authority.test.ts :7 } from "node:fs";
  • fs comisai-comis-641d4af/packages/agent/src/background/background-recovery-authority.ts :12 } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/background/background-task-manager.test.ts :15 } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/background/background-task-persistence.test.ts :16 } from "node:fs";
  • fs comisai-comis-641d4af/packages/agent/src/background/background-task-persistence.ts :25 } from "node:fs";
show 28 more
  • fs (weak) comisai-comis-641d4af/packages/agent/src/background/background-task-recovery-controller.test.ts :15 } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/background/dispatchstate.test.ts :17 import { mkdirSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/bootstrap/workspace-loader.test.ts :2 import * as fs from "node:fs/promises";
  • fs comisai-comis-641d4af/packages/agent/src/bootstrap/workspace-loader.ts :13 import * as fs from "node:fs/promises";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/bridge/pi-event-bridge.test.ts :6716 // log. The dispatch chain awaits fs.readFile, which takes a variable number
  • fs (weak) comisai-comis-641d4af/packages/agent/src/bridge/thinking-block-hash-invariant.test.ts :20 import { readFileSync } from "node:fs";
  • fs comisai-comis-641d4af/packages/agent/src/bridge/thinking-block-hash-invariant.ts :47 import { readFile as fsReadFile } from "node:fs/promises";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/context-engine/compaction-span-invariant.test.ts :44 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/context-engine/microcompaction-guard.test.ts :13 import { mkdtempSync, mkdirSync, existsSync, readFileSync, rmSync, statSync } from "node:fs";
  • fs comisai-comis-641d4af/packages/agent/src/context-engine/microcompaction-guard.ts :41 import { readFileSync, statSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/context-engine/provider-boundary-harness.test.ts :40 } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/__test-helpers/capturing-provider-stub.ts :27 import { mkdtempSync, writeFileSync, readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/cache-break-diff-writer.test.ts :3 import { mkdtempSync, statSync, rmSync, readdirSync as realReaddirSync } from "node:fs";
  • fs comisai-comis-641d4af/packages/agent/src/executor/cache-break-diff-writer.ts :13 import { readdirSync, unlinkSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/cache-detection/cache-state.test.ts :19 import * as fs from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/citation-evidence.test.ts :3 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/command-directive-types.test.ts :30 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/continuation-turn.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/details-prompt-isolation.test.ts :9 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/executor-post-execution.test.ts :15 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/executor-tool-pipeline.test.ts :21 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/fault-injector.test.ts :3 import { mkdtempSync, writeFileSync, existsSync, rmSync } from "node:fs";
  • fs comisai-comis-641d4af/packages/agent/src/executor/fault-injector.ts :30 import { unlinkSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/lcd-compaction-trigger.test.ts :28 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/pending-background-reply.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/phase-filter.test.ts :8 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/pi-executor/agent-session-contract.test.ts :17 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) comisai-comis-641d4af/packages/agent/src/executor/pi-executor/locale-delta-delivery.test.ts :2 import { readFileSync } from "node:fs";

360 more not shown — this panel samples each group; the count above is the real total.

shell / exec 268

  • shell (weak) comisai-comis-641d4af/.github/scripts/prepare-capability-service-fixture.mjs :5 import { execFileSync } from "node:child_process";
  • shell (weak) comisai-comis-641d4af/packages/agent/src/bootstrap/sections/tool-descriptions.test.ts :161 // and message.attach + sandbox-exec (correctly) rejected them.
  • shell comisai-comis-641d4af/packages/agent/src/bootstrap/sections/tool-descriptions.ts :556 To run CLI tools that need API tokens (wrangler, gh, gcloud, kubectl, doctl, fly, vercel, stripe, etc.), use the \`secretRefs\` parameter — pass the secret NAMES as a list; the daemon resolves them an
  • shell comisai-comis-641d4af/packages/agent/src/bootstrap/sections/tooling-sections.ts :188 "Never modify config YAML files directly -- not via read/edit/write tools, and not via exec (sed, awk, tee, etc.).",
  • shell (weak) comisai-comis-641d4af/packages/agent/src/bridge/pi-event-bridge.test.ts :7632 // A sub-agent whose active set was fixed at spawn (here ['full'] — the
  • shell comisai-comis-641d4af/packages/agent/src/bridge/pi-event-bridge.ts :457 * spawn (the runaway-tree backstop holds); preserves the $ aggregate. Optional
  • shell (weak) comisai-comis-641d4af/packages/agent/src/executor/active-run-registry.test.ts :274 const { execSync } = await import("node:child_process");
  • shell (weak) comisai-comis-641d4af/packages/agent/src/executor/capability-index-context.test.ts :557 // TOOL_ORDER: read (0), edit (1), notebook_edit (2), write (3), exec (4)
  • shell comisai-comis-641d4af/packages/agent/src/executor/dag-templates.ts :253 * Uses exec() loop on a fresh regex instance to avoid lastIndex issues.
  • shell comisai-comis-641d4af/packages/agent/src/executor/executor-response-filter.ts :789 return `exec({command: "${preview}"})`;
  • shell (weak) comisai-comis-641d4af/packages/agent/src/executor/jit-guide-injector.test.ts :295 it("does not inject guides on second use of exec (only delivers once)", () => {
  • shell (weak) comisai-comis-641d4af/packages/agent/src/identity/identity-updater-branches.test.ts :9 * - non-Error throw from writeFile/git execFile (line 139 cond-expr)
show 28 more
  • shell (weak) comisai-comis-641d4af/packages/agent/src/identity/identity-updater.test.ts :2 import * as childProcess from "node:child_process";
  • shell comisai-comis-641d4af/packages/agent/src/identity/identity-updater.ts :4 import * as childProcess from "node:child_process";
  • shell (weak) comisai-comis-641d4af/packages/agent/src/model/__tests__/oauth-lock-contract.test.ts :25 import { spawn } from "node:child_process";
  • shell comisai-comis-641d4af/packages/agent/src/model/operation-model-resolver.ts :41 * spawn (setup-cross-session-graph.ts hardcodes 600_000ms) — the resolver
  • shell (weak) comisai-comis-641d4af/packages/agent/src/spawn/announce-key.test.ts :17 it("returns undefined for a top-level spawn (no callerSessionKey)", () => {
  • shell comisai-comis-641d4af/packages/agent/src/spawn/announce-key.ts :28 * Returns `undefined` for a top-level spawn (no `callerSessionKey`) or an
  • shell comisai-comis-641d4af/packages/agent/src/spawn/coordinator-progress-fork.ts :17 * spawn (fork-bomb); this one cannot, by construction.
  • shell (weak) comisai-comis-641d4af/packages/agent/src/spawn/sandbox-posture.test.ts :243 it("leaves filesystem, network, and uid unset — the sub-agent resolver populates only exec (inert dimensions)", () => {
  • shell comisai-comis-641d4af/packages/agent/src/spawn/sandbox-posture.ts :247 * @allow-throw: spawn() is consumed exclusively by daemon RPC handlers
  • shell comisai-comis-641d4af/packages/agent/src/spawn/sub-agent-failure-notification.ts :102 // a top-level spawn (no callerSessionKey) → no dedup.
  • shell comisai-comis-641d4af/packages/agent/src/spawn/sub-agent-result-processor.ts :407 // reconstruct it downstream. Undefined for a top-level spawn (no callerSessionKey).
  • shell (weak) comisai-comis-641d4af/packages/agent/src/spawn/sub-agent-runner.durable.test.ts :7 * - a cron-fired spawn (isCronAgentTurn + jobId) writes a checkpoint whose
  • shell (weak) comisai-comis-641d4af/packages/agent/src/spawn/sub-agent-runner.test.ts :3657 // (and the in-process agent loop) hit — it bounds a for(;;) spawn() tree-
  • shell comisai-comis-641d4af/packages/agent/src/spawn/sub-agent-runner.ts :276 /** Lease that authorized this spawn (revocation-cascade correlation); undefined for the root. */
  • shell comisai-comis-641d4af/packages/agent/src/workspace/data-env.ts :38 * @returns env-var record suitable for `child_process.spawn(..., { env })`.
  • shell (weak) comisai-comis-641d4af/packages/channels/src/imessage/credential-validator.test.ts :10 import { execFile } from "node:child_process";
  • shell comisai-comis-641d4af/packages/channels/src/imessage/credential-validator.ts :14 import { execFile } from "node:child_process";
  • shell (weak) comisai-comis-641d4af/packages/channels/src/imessage/imessage-client.test.ts :51 const actual = await importOriginal<typeof import("node:child_process")>();
  • shell comisai-comis-641d4af/packages/channels/src/imessage/imessage-client.ts :18 import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
  • shell (weak) comisai-comis-641d4af/packages/channels/src/msteams/__tests__/msteams-adapter.test.ts :3 import { execFileSync } from "node:child_process";
  • shell (weak) comisai-comis-641d4af/packages/channels/src/msteams/__tests__/msteams-auth.test.ts :3 import { execFileSync } from "node:child_process";
  • shell (weak) comisai-comis-641d4af/packages/cli/src/commands/daemon-behavior.test.ts :64 const childProcess = await import("node:child_process");
  • shell comisai-comis-641d4af/packages/cli/src/commands/daemon.ts :15 import { execFile, spawn } from "node:child_process";
  • shell comisai-comis-641d4af/packages/cli/src/commands/pm2.ts :13 import { execFile, spawn } from "node:child_process";
  • shell (weak) comisai-comis-641d4af/packages/cli/src/commands/signal-setup-behavior.test.ts :52 const childProcess = await import("node:child_process");
  • shell (weak) comisai-comis-641d4af/packages/cli/src/commands/signal-setup.test.ts :32 it("does not import execSync (only execFileSync)", () => {
  • shell comisai-comis-641d4af/packages/cli/src/commands/signal-setup.ts :14 import { execFileSync } from "node:child_process";
  • shell comisai-comis-641d4af/packages/cli/src/commands/uninstall.ts :16 import { spawn, execFile } from "node:child_process";

228 more not shown — this panel samples each group; the count above is the real total.

network 253

  • net (weak) comisai-comis-641d4af/packages/agent/src/model/oauth-token-manager.test.ts :539 * `fetch("https://auth.openai.com/oauth/token", ...)`. To keep the broad
  • net comisai-comis-641d4af/packages/agent/src/model/oauth-token-manager.ts :376 response = await fetch(tokenUrl, {
  • net comisai-comis-641d4af/packages/agent/src/model/ollama-capacity-probe.ts :13 * Never call raw `fetch()` in this module — always use the injected `fetchFn`.
  • net (weak) comisai-comis-641d4af/packages/agent/src/provider/response/sanitize-pipeline.test.ts :251 "[Tool Call: search (ID: id1)]\n[Tool Call: fetch (ID: id2)]\nContent after";
  • net comisai-comis-641d4af/packages/agent/src/spawn/sub-agent-error-classification.ts :24 * phrasings emitted by undici/fetch ("fetch failed", "network request failed",
  • net comisai-comis-641d4af/packages/channels/src/discord/discord-actions.ts :48 const channel = await client.channels.fetch(channelId);
  • net comisai-comis-641d4af/packages/channels/src/discord/discord-adapter-types.ts :5 * `client.channels.fetch()`.
  • net comisai-comis-641d4af/packages/channels/src/discord/discord-adapter.ts :351 const channel = await client.channels.fetch(channelId);
  • net comisai-comis-641d4af/packages/channels/src/discord/discord-reaction-binder.ts :16 * message; `reaction.fetch()` must resolve it before `messageId`/`emoji` can
  • net comisai-comis-641d4af/packages/channels/src/discord/voice-sender.ts :124 const step1Res = await fetch(`${DISCORD_API_BASE}/channels/${channelId}/attachments`, {
  • net comisai-comis-641d4af/packages/channels/src/email/imap-lifecycle.ts :111 for await (const msg of c.fetch(range, {
  • net (weak) comisai-comis-641d4af/packages/channels/src/msteams/__tests__/msteams-adapter.test.ts :1797 it("rejects an unsafe messageId on edit with an err before any fetch (T-8)", async () => {
show 28 more
  • net comisai-comis-641d4af/packages/channels/src/msteams/msteams-plugin.ts :38 * superset of the plain `fetch(url)` seam: `opts` carries the Authorization
  • net (weak) comisai-comis-641d4af/packages/channels/src/msteams/msteams-resolver.test.ts :291 it("rejects an off-allowlist hop-0 fetch host BEFORE any fetch (closes the blind-public-SSRF residual)", async () => {
  • net comisai-comis-641d4af/packages/channels/src/msteams/msteams-resolver.ts :40 * plain `fetch(url)` seam: `opts` carries the Authorization header value and the
  • net comisai-comis-641d4af/packages/channels/src/signal/signal-client.ts :156 const res = await fetch(`${baseUrl}/api/v1/rpc`, {
  • net comisai-comis-641d4af/packages/channels/src/slack/media-handler.ts :116 const initialRes = await fetch(parsed.href, {
  • net (weak) comisai-comis-641d4af/packages/channels/src/slack/slack-resolver.test.ts :18 // Mock global fetch (for files.info)
  • net comisai-comis-641d4af/packages/channels/src/slack/slack-resolver.ts :78 const infoRes = await fetch("https://slack.com/api/files.info", {
  • net (weak) comisai-comis-641d4af/packages/channels/src/telegram/telegram-adapter/telegram-auto-retry-exactness.test.ts :3 import { createServer, type Server } from "node:http";
  • net (weak) comisai-comis-641d4af/packages/channels/src/telegram/telegram-adapter/telegram-grammy-restart.test.ts :3 import { createServer, type Server } from "node:http";
  • net comisai-comis-641d4af/packages/channels/src/telegram/telegram-plugin.ts :22 fetch(url: string): Promise<Result<{ buffer: Buffer; mimeType: string; sizeBytes: number }, Error>>;
  • net comisai-comis-641d4af/packages/channels/src/telegram/telegram-resolver.ts :29 fetch(url: string): Promise<Result<{ buffer: Buffer; mimeType: string; sizeBytes: number }, Error>>;
  • net comisai-comis-641d4af/packages/cli/src/commands/daemon.ts :119 const res = await fetch(url, { signal: controller.signal });
  • net comisai-comis-641d4af/packages/cli/src/commands/signal-setup.ts :187 const response = await fetch(
  • net comisai-comis-641d4af/packages/cli/src/doctor/checks/gateway-health.ts :11 import * as net from "node:net";
  • net comisai-comis-641d4af/packages/cli/src/doctor/checks/msteams-health.ts :193 const response = await fetch(url, {
  • net comisai-comis-641d4af/packages/cli/src/doctor/checks/oauth-health.ts :321 const response = await fetch(OPENAI_TOKEN_URL, {
  • net (weak) comisai-comis-641d4af/packages/cli/src/security/checks/skills-code.test.ts :5 * Verifies skillsCodeCheck produces correct findings for fetch() calls,
  • net comisai-comis-641d4af/packages/cli/src/security/checks/skills-code.ts :27 label: "Network access via fetch()",
  • net comisai-comis-641d4af/packages/cli/src/tooling-fill/agent-call.ts :28 import * as http from "node:http";
  • net comisai-comis-641d4af/packages/cli/src/wizard/steps/04-credentials.ts :203 const response = await fetch(url, {
  • net comisai-comis-641d4af/packages/cli/src/wizard/steps/06-channels.ts :10 * Live validation uses native fetch (Node 22+) with AbortController
  • net comisai-comis-641d4af/packages/cli/src/wizard/steps/11-daemon-start.ts :123 const res = await fetch(url, { signal: controller.signal });
  • net (weak) comisai-comis-641d4af/packages/core/src/oauth/openai-codex-browser-login.test.ts :109 void fetch(`http://127.0.0.1:${serverPort}/auth/callback?code=cb-code&state=${state}`);
  • net comisai-comis-641d4af/packages/core/src/oauth/openai-codex-browser-login.ts :22 import { createServer } from "node:http";
  • net comisai-comis-641d4af/packages/core/src/ports/channel.ts :336 /** Maximum number of messages to fetch (default: 20) */
  • net comisai-comis-641d4af/packages/core/src/security/ssrf-guard.ts :10 * the connection. PINNING the resolved IP for the actual fetch (closing the
  • net (weak) comisai-comis-641d4af/packages/daemon/bundled-skills/chart-visualization/scripts/generate.cjs :51 const response = await fetch(url, {
  • net (weak) comisai-comis-641d4af/packages/daemon/src/__tests__/capability-service-protocol-fixture-server.test.ts :2 import net from "node:net";

213 more not shown — this panel samples each group; the count above is the real total.

secrets 52

  • secrets (weak) comisai-comis-641d4af/packages/agent/src/memory/benchmark/contradiction-harness.bench.test.ts :124 const ANSWER_API_KEY = process.env.COMIS_BENCH_ANSWER_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/agent/src/memory/benchmark/poisoning-harness.bench.test.ts :125 const ANSWER_API_KEY = process.env.COMIS_BENCH_ANSWER_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/agent/src/memory/benchmark/prove2-qa-lift.bench.test.ts :95 const ANSWER_API_KEY = process.env.COMIS_BENCH_ANSWER_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/agent/src/memory/benchmark/qa-judge-harness.bench.test.ts :121 const ANSWER_API_KEY = process.env.COMIS_BENCH_ANSWER_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/agent/src/model/auth-storage-adapter.test.ts :559 const saved = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/client/rpc-client.test.ts :686 delete process.env["COMIS_GATEWAY_TOKEN"];
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/commands/auth.test.ts :521 delete process.env.COMIS_GATEWAY_TOKEN;
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/commands/edge-utilities.test.ts :172 delete process.env["COMIS_GATEWAY_TOKEN"];
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/commands/mcp-behavior.test.ts :87 process.env["COMIS_GATEWAY_TOKEN"] = "test-token";
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/commands/mcp-oauth.test.ts :122 process.env["COMIS_GATEWAY_TOKEN"] = "test-token"; // skip the miss path here
  • secrets comisai-comis-641d4af/packages/cli/src/commands/mcp-token.ts :49 process.env["COMIS_GATEWAY_TOKEN"] = flagToken;
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/commands/mcp.test.ts :29 savedToken = process.env["COMIS_GATEWAY_TOKEN"];
show 28 more
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/tooling-fill/orchestrator-branches.test.ts :218 process.env["COMIS_GATEWAY_TOKEN"] = "test-token";
  • secrets (weak) comisai-comis-641d4af/packages/cli/src/tooling-fill/orchestrator.test.ts :284 process.env["COMIS_GATEWAY_TOKEN"] = "test-token";
  • secrets (weak) comisai-comis-641d4af/packages/daemon/src/api/agent-handlers.test.ts :2086 delete process.env.OPENROUTER_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/daemon/src/api/config-handlers.test.ts :2164 delete process.env.OPENROUTER_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/daemon/src/api/pi-image-adapter.test.ts :617 it.skipIf(!process.env.OPENROUTER_API_KEY)(
  • secrets (weak) comisai-comis-641d4af/packages/daemon/src/api/shared/credential-resolver.test.ts :63 delete process.env.OPENROUTER_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/daemon/src/daemon-boot-gate.test.ts :255 delete process.env["SECRETS_MASTER_KEY"];
  • secrets (weak) comisai-comis-641d4af/packages/daemon/src/daemon-harness-env.test.ts :21 delete process.env["ANTHROPIC_API_KEY"];
  • secrets (weak) comisai-comis-641d4af/packages/daemon/src/daemon.test.ts :981 process.env["SECRETS_MASTER_KEY"] = keyHex;
  • secrets (weak) comisai-comis-641d4af/packages/memory/src/embedding-provider-openai.test.ts :13 const OPENAI_API_KEY = process.env.OPENAI_API_KEY;
  • secrets (weak) comisai-comis-641d4af/packages/skills/src/skills/integrations/mcp-client/mcp-client-discover.test.ts :124 process.env.OPENAI_API_KEY = "secret";
  • secrets (weak) comisai-comis-641d4af/scripts/token-fixtures/generate.mjs :143 const apiKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) comisai-comis-641d4af/test/e2e/cli-mcp.test.ts :149 priorGatewayToken = process.env["COMIS_GATEWAY_TOKEN"];
  • secrets (weak) comisai-comis-641d4af/test/integration/cli-rpc-roundtrip.test.ts :41 process.env["COMIS_GATEWAY_TOKEN"] = handle.authToken;
  • secrets (weak) comisai-comis-641d4af/test/integration/credential-storage-modes.test.ts :99 const originalMasterKey = process.env["SECRETS_MASTER_KEY"];
  • secrets (weak) comisai-comis-641d4af/test/integration/durable-resume-e2e.test.ts :280 priorGatewayToken = process.env["COMIS_GATEWAY_TOKEN"];
  • secrets (weak) comisai-comis-641d4af/test/integration/env-vars-daemon.test.ts :56 delete process.env["POST_BOOT_KEY"];
  • secrets (weak) comisai-comis-641d4af/test/integration/env-vars-unit.test.ts :338 const originalToken = process.env["COMIS_GATEWAY_TOKEN"];
  • secrets (weak) comisai-comis-641d4af/test/integration/memory-portability-roundtrip.test.ts :88 process.env["COMIS_GATEWAY_TOKEN"] = handle.authToken;
  • secrets (weak) comisai-comis-641d4af/test/integration/persist-management-e2e.test.ts :71 describe.skipIf(!process.env.OPENAI_API_KEY)("Management Action YAML Persistence", () => {
  • secrets (weak) comisai-comis-641d4af/test/integration/persist-restart-e2e.test.ts :98 priorGatewayToken = process.env["COMIS_GATEWAY_TOKEN"];
  • secrets (weak) comisai-comis-641d4af/test/integration/secrets-lifecycle.test.ts :72 originalMasterKey = process.env["SECRETS_MASTER_KEY"];
  • secrets (weak) comisai-comis-641d4af/test/integration/web-console-management-rpc.test.ts :71 process.env["GATEWAY_TOKEN_ADMIN_TOKEN"] = ADMIN_SECRET;
  • secrets (weak) comisai-comis-641d4af/test/live/bin/vps-emu.ts :41 const BOT_TOKEN = process.env["EMU_BOT_TOKEN"] ?? "1234567:emulator-fake-token";
  • secrets (weak) comisai-comis-641d4af/test/live/credentials.test.ts :16 savedAnthropicKey = process.env["ANTHROPIC_API_KEY"];
  • secrets (weak) comisai-comis-641d4af/test/live/judge.test.ts :191 writeFileSync(join(dir, "source.ts"), 'const apiKey = process.env["COMIS_LIVE_JUDGE_API_KEY"];\nif (!apiKey) return;');
  • secrets (weak) comisai-comis-641d4af/test/live/judge.ts :109 const apiKey = process.env["COMIS_LIVE_JUDGE_API_KEY"];
  • secrets (weak) comisai-comis-641d4af/test/live/scenarios/memory/embedding-matrix.test.ts :23 const hasOpenAiKey = !!process.env["OPENAI_API_KEY"];

12 more not shown — this panel samples each group; the count above is the real total.

database 226

  • db (weak) comisai-comis-641d4af/packages/agent/src/context-engine/lcd-assembler.test.ts :28 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/context-engine/lcd-synthetic-session.test.ts :40 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/context-engine/provider-boundary-harness.test.ts :54 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/executor/lcd-bootstrap-sweep.test.ts :48 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/executor/lcd-compaction-trigger.test.ts :25 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/executor/lcd-condense-trigger.test.ts :27 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/executor/lcd-ingest.test.ts :38 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/executor/projected-history-lcd-reconciliation.test.ts :11 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/executor/session-compaction-trigger.test.ts :17 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/rag/memory-recall.test.ts :57 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/agent/src/session/session-reset-integration.test.ts :3 import Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/cli/src/commands/doctor.ts :14 import Database from "better-sqlite3";
show 28 more
  • db (weak) comisai-comis-641d4af/packages/cli/src/commands/sessions.test.ts :637 import Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/cli/src/commands/sessions.ts :17 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/cli/src/doctor/checks/lcd-health.test.ts :17 import Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/cli/src/doctor/checks/lcd-health.ts :21 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/cli/src/doctor/repairs/repair-lcd.test.ts :16 import Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/cli/src/doctor/repairs/repair-lcd.ts :51 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/api/obs-handlers/obs-audit.test.ts :21 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/api/obs-handlers/obs-cache-breaks.test.ts :20 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/api/obs-handlers/obs-explain-golden-layout.test.ts :39 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/api/obs-handlers/obs-spend.test.ts :23 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/api/obs-handlers/system-health.test.ts :42 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/api/video-status-handlers.test.ts :20 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/autonomy/durable-resume-engine.test.ts :17 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/observability/obs-persistence-reset.test.ts :3 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/observability/obs-persistence-wiring.test.ts :51 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/capability-service-shape-conformance.test.ts :20 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/gateway-attachment-persistence.test.ts :3 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/managed-run-activation-coordinator.test.ts :6 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/managed-run-activation-recovery.test.ts :6 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/managed-run-evidence-bridge.test.ts :6 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/managed-run-group-activation-coordinator.test.ts :5 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/managed-run-report-bridge.test.ts :5 import Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/mcp-token-store-encrypted.test.ts :28 import Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/daemon/src/wiring/mcp-token-store-encrypted.ts :21 import type Database from "better-sqlite3";
  • db (weak) comisai-comis-641d4af/packages/daemon/src/wiring/select-mcp-token-store.test.ts :36 import Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/daemon/src/wiring/select-mcp-token-store.ts :40 import type Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/daemon/src/wiring/setup-agents/setup-agents-registry.ts :18 import type Database from "better-sqlite3";
  • db comisai-comis-641d4af/packages/daemon/src/wiring/setup-agents/setup-agents-types.ts :23 import type Database from "better-sqlite3";

186 more not shown — this panel samples each group; the count above is the real total.

install hooks 2

  • prepare comisai-comis-641d4af/package.json :81 pnpm hooks:install
  • prepack comisai-comis-641d4af/packages/comis/package.json :138 node scripts/prepack.js

declared dependencies 39

  • @modelcontextprotocol/sdk@1.29.0
  • @agentclientprotocol/sdk@0.22.1
  • @comis/core@workspace:*
  • @earendil-works/pi-agent-core@0.84.0
  • @earendil-works/pi-ai@0.84.0
  • @eslint/js@10.0.1
  • @line/bot-sdk@10.8.0
  • @mdx-js/mdx@3.1.1
  • @slack/web-api@7.16.0
  • @types/node@22.20.1
  • @types/semver@7.7.1
  • ajv@8.20.0
show 27 more
  • ajv-formats@3.0.1
  • @types/ws@8.18.1
  • @vitest/coverage-v8@4.1.10
  • better-sqlite3@12.10.0
  • esbuild@0.28.1
  • eslint@10.4.1
  • eslint-plugin-security@4.0.1
  • globals@17.6.0
  • grammy@1.43.0
  • hono@4.13.0
  • jose@6.2.4
  • madge@8.0.0
  • node-llama-cpp@3.18.1
  • nodemailer@9.0.3
  • p-queue@9.3.3
  • pino@10.3.1
  • pino-pretty@13.1.3
  • remark-frontmatter@5.0.0
  • semver@7.8.5
  • sqlite-vec@0.1.9
  • tsx@4.22.5
  • typescript@5.9.3
  • typescript-eslint@8.60.1
  • vitest@4.1.10
  • ws@8.21.1
  • yaml@2.9.0
  • zod@4.4.3

obfuscation 2

  • dynamic require()/import() comisai-comis-641d4af/scripts/token-fixtures/generate.mjs :183 const { getLlama } = await import("file://" + req.resolve("node-llama-cpp"));
  • dynamic require()/import() comisai-comis-641d4af/test/live/self-driving/scripts/_rig.mjs :115 export const importCli = (rel) => import(comisDist("cli", `dist/${rel}`));

perm:untrusted 4

  • untrusted (weak) comisai-comis-641d4af/test/live/bin/ask.mjs :28 const getJson = async (u) => (await fetch(u)).json();
  • untrusted (weak) comisai-comis-641d4af/test/live/harness/backends/http-backend.test.ts :160 const native = (await (await fetch(`${apiRoot}/bot1:t/sendMessage`, { method: "POST", body: "{}" })).json()) as {
  • untrusted (weak) comisai-comis-641d4af/test/live/self-driving/scripts/media-drive.mjs :60 (await fetch(`${base}/control/chats/${chatId}/outbound?afterMessageId=${after}&waitMs=${waitMs}`)).json();
  • untrusted (weak) comisai-comis-641d4af/test/live/self-driving/scripts/model-battery.mjs :30 const getOut = async (after, waitMs) => (await fetch(`${base}/control/chats/${chatId}/outbound?afterMessageId=${after}&waitMs=${waitMs}`)).json();

transport_posture 17

  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/cli/src/commands/daemon.ts :145 let host = "0.0.0.0";
  • binds all interfaces (0.0.0.0) comisai-comis-641d4af/packages/cli/src/doctor/diagnostic-suite.test.ts :45 gateway: { host: "0.0.0.0", port: 9876 },
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/cli/src/security/checks/gateway-exposure.test.ts :42 contextWithGateway({ host: "0.0.0.0", port: 3000 }),
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/cli/src/support-bundle/generate.test.ts :274 const ctx = contextFrom("gateway:\n host: '::'\n port: 4766\n");
  • binds all interfaces (0.0.0.0) comisai-comis-641d4af/packages/cli/src/wizard/steps/10-write-config.ts :187 host = "0.0.0.0";
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/core/src/config/env-layer.test.ts :18 gateway: { host: "0.0.0.0" },
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/core/src/config/layered.test.ts :233 const result = loadLayered([file], { envLayer: { gateway: { host: "0.0.0.0" } } });
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/core/src/config/schema-gateway.test.ts :79 expect(GatewayConfigSchema.safeParse({ host: "0.0.0.0" }).success).toBe(true);
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/daemon/src/daemon-boot-gate.test.ts :52 host: "0.0.0.0",
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/daemon/src/daemon.test.ts :41 host: "0.0.0.0",
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/daemon/src/wiring/setup-observability.test.ts :557 prometheus: { enabled: true, host: "0.0.0.0" },
  • binds all interfaces (0.0.0.0) comisai-comis-641d4af/packages/gateway/src/server/hono-server.test.ts :118 const config = { ...defaultConfig(), host: "0.0.0.0", port: 0 };
show 5 more
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/skills/src/tools/builtin/file/apply-patch-tool.test.ts :155 "+const host = '0.0.0.0';",
  • binds all interfaces (0.0.0.0) comisai-comis-641d4af/packages/web/e2e/config-editor.spec.ts :24 host: "0.0.0.0",
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/packages/web/src/views/config-editor.test.ts :48 host: "0.0.0.0",
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/test/architecture/installer-gateway-wait-window.test.ts :171 configYaml: "gateway:\n host: '::'\n port: 8878\n",
  • network-listening, binds all interfaces, no auth detected comisai-comis-641d4af/test/integration/config-env-include-e2e.test.ts :206 ' host: "0.0.0.0"',