github Python analyzed 884f46b deep scan · partial (90/2,545 files)

coryhacking/wavefoundry

Wave-based development lifecycle and code intelligence framework for AI-assisted engineering. Includes semantic + graph indexing, MCP tool surface, built-in secrets detection with lifecycle gates, and a local dashboard for inspecting project health, active work, and diffs.

maintainer: coryhacking
licence: Apache-2.0
first seen: 2026-06-06
last seen: 2026-09-10
releases · 30d: 11
short id

Drift inferred · capture-to-capture

HIGH 2026-09-10 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-09-08 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-30 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-28 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-24 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-22 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-17 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-16 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-14 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-13 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-13 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-12 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-12 code analysis flagged committed secret in coryhacking/wavefoundry
HIGH 2026-08-08 code analysis flagged committed secret ×2, dynamic code execution ×6 in coryhacking/wavefoundry
HIGH 2026-07-30 code analysis flagged committed secret ×2, dynamic code execution ×6 in coryhacking/wavefoundry
HIGH 2026-07-19 code analysis flagged committed secret, dynamic code execution ×2 in coryhacking/wavefoundry
HIGH 2026-07-15 code analysis flagged committed secret, dynamic code execution ×2 in coryhacking/wavefoundry
HIGH 2026-07-10 code analysis flagged committed secret, dynamic code execution ×2 in coryhacking/wavefoundry
HIGH 2026-07-06 code analysis flagged committed secret, dynamic code execution ×2 in coryhacking/wavefoundry
HIGH 2026-07-03 code analysis flagged hidden prompt content, committed secret, dynamic code execution ×2 in coryhacking/wavefoundry

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 884f46b · analyzer v33 · 3h ago

skills & prompt files 40

danger signals8

dynamic code execution __import__() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/chunker.py :50 mod = __import__(module_name, fromlist=[lang_fn])
dynamic code execution __import__() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_graph_indexer.py :3706 __import__(lang_skip_mod)
dynamic code execution eval()/exec() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_render_platform_surfaces.py :1694 exec(compile(self.mod.HOOK_BOOTSTRAP, "<bootstrap>", "exec"), ns) # must not raise
dynamic code execution eval()/exec() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_upgrade_wavefoundry.py :424 exec(compile(source, "<test>", "exec"), m.__dict__)
dynamic code execution __import__() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_venv_bootstrap.py :121 mod = __import__(unique) # would ImportError if addsitedir didn't make sp live
dynamic code execution eval()/exec() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/upgrade_wavefoundry.py :1127 exec(compile(source, candidate, "exec"), mod.__dict__)
committed secret Google API key coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scan-rules.toml :1502 AIzaSy…(39 chars, redacted)
committed secret Stripe live key coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_secrets_validators.py :921 sk_liv…(40 chars, redacted)

code evidence vv1.22.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 241

filesystem 217

fs coryhacking-wavefoundry-884f46b/.claude/hooks/context-efficiency-project.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.claude/hooks/post-edit.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.claude/hooks/pre-edit.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.claude/hooks/session-capture.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.claude/hooks/simulate-hooks.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.cursor/hooks/after-file-edit.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.cursor/hooks/docs-lint.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.cursor/hooks/framework-plan-warn.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.cursor/hooks/seed-warn.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.github/hooks/post-tool-use.py :5 from pathlib import Path as _WfPath
fs coryhacking-wavefoundry-884f46b/.github/hooks/pre-tool-use.py :5 from pathlib import Path as _WfPath
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/accel_embedder.py :24 from pathlib import Path

show 28 more

fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/agent_surface_integrity.py :5 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/ann_reference_eval.py :27 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/benchmarks/compare_retrieval_receipts.py :49 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/benchmarks/embed_bench.py :31 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/build_pack.py :23 import shutil
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/build_scan_allowlist.py :18 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/check_version.py :26 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/chunker.py :11 from pathlib import PurePosixPath
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/cli_stdio.py :52 devnull_fd = os.open(os.devnull, os.O_WRONLY)
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/commit_provenance.py :20 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/context_efficiency.py :25 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/dashboard_lib.py :15 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/dashboard_server.py :22 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/design_token_build.py :35 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/docs_gardener.py :12 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/docs_lint.py :6 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/eval_chunker.py :21 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/exploration_avoided.py :39 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/gen_codebase_map.py :44 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/gpu_doctor.py :17 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/graph_cluster.py :15 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/graph_indexer.py :19 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/graph_quality_eval.py :35 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/graph_query.py :14 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/index_state_store.py :37 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/indexer.py :11 import shutil
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/install_log_lib.py :27 from pathlib import Path
fs (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/lexical_ranking_eval.py :33 from pathlib import Path

177 more not shown — this panel samples each group; the count above is the real total.

shell / exec 93

shell coryhacking-wavefoundry-884f46b/.claude/hooks/context-efficiency-project.py :24 import subprocess
shell coryhacking-wavefoundry-884f46b/.claude/hooks/post-edit.py :25 import subprocess
shell coryhacking-wavefoundry-884f46b/.claude/hooks/pre-edit.py :25 import subprocess
shell coryhacking-wavefoundry-884f46b/.claude/hooks/session-capture.py :24 import subprocess
shell coryhacking-wavefoundry-884f46b/.claude/hooks/simulate-hooks.py :24 import subprocess
shell coryhacking-wavefoundry-884f46b/.cursor/hooks/after-file-edit.py :25 import subprocess
shell coryhacking-wavefoundry-884f46b/.cursor/hooks/docs-lint.py :25 import subprocess
shell coryhacking-wavefoundry-884f46b/.cursor/hooks/framework-plan-warn.py :25 import subprocess
shell coryhacking-wavefoundry-884f46b/.cursor/hooks/seed-warn.py :25 import subprocess
shell coryhacking-wavefoundry-884f46b/.github/hooks/post-tool-use.py :25 import subprocess
shell coryhacking-wavefoundry-884f46b/.github/hooks/pre-tool-use.py :25 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/build_pack.py :24 import subprocess

show 28 more

shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/dashboard_lib.py :72 # Win32_Process.CommandLine form from subprocess.list2cmdline) or a bare whitespace-delimited token.
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/dashboard_server.py :14 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/docs_gardener.py :9 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/graph_indexer.py :14 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/graph_quality_eval.py :528 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/index_state_store.py :34 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/indexer.py :12 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/provider_policy.py :9 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/render_platform_surfaces.py :261 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/retrieval_eval.py :23 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/run_tests.py :37 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/server_impl.py :142 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/setup_index.py :16 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/setup_wavefoundry.py :25 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/sqlite_storage_migration.py :21 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/subprocess_util.py :50 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/techdocs_audit_lib.py :1624 import subprocess # noqa: PLC0415
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/oracle/techdocs_boundary_differential.py :48 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/server_tools_support.py :25 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/sqlite_conversion_eval.py :16 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/sqlite_event_eval.py :18 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_accel_embedder.py :275 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_build_pack.py :359 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_commit_provenance.py :11 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_context_efficiency.py :9 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_dashboard_server.py :3522 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_design_token_build.py :14 import subprocess
shell (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_doc_drift.py :20 import subprocess

53 more not shown — this panel samples each group; the count above is the real total.

network 10

net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/chunker.py :2711 import urllib.parse as _urlparse
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/dashboard_server.py :13 import socket
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/server_impl.py :14202 import urllib.request
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/setup_index.py :600 # no-op (the same import-time-caching hazard class as the cached global httpx.Client that
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/techdocs_audit_lib.py :1123 from urllib.parse import unquote # noqa: PLC0415
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_chunker.py :6778 import urllib.parse as up
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_server_tools.py :4406 import urllib.request
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_setup_index.py :725 raise RuntimeError("httpx.ConnectError: nodename nor servname provided, or not known")
net (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/wave_lint_lib/link_validators.py :6 from urllib.parse import unquote
net (weak) coryhacking-wavefoundry-884f46b/docs/waves/1wl7w diagram-label-retrieval/evidence/build_fixtures_1wl7v.py :33 import urllib.parse

secrets 5

secrets (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/index_state_store.py :3059 token = os.environ.get("WAVEFOUNDRY_UPGRADE_PUBLISHER_TOKEN", "").strip()
secrets (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_index_state_store.py :995 os.environ["WAVEFOUNDRY_UPGRADE_PUBLISHER_TOKEN"] = token
secrets (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_secrets_validators.py :292 target.write_text('key = os.environ.get("STRIPE_KEY")\n', encoding="utf-8")
secrets (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_upgrade_wavefoundry.py :3106 os.environ["WAVEFOUNDRY_UPGRADE_PUBLISHER_TOKEN"] = "bridge-token"
secrets (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/upgrade_extensions.py :1232 if os.environ.get("WAVEFOUNDRY_UPGRADE_PUBLISHER_TOKEN") != token:

database 26

db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/context_efficiency.py :19 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/exploration_avoided.py :36 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/graph_indexer.py :13 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/index_state_store.py :26 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/memory_backfill.py :16 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/memory_records.py :691 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/server_impl.py :9726 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/server_tools_support.py :24 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_context_efficiency.py :8 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_fts_lexical_layer.py :17 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_fts_query_honesty.py :25 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_graph_incremental_merge.py :30 import sqlite3

show 14 more

db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_graph_indexer.py :7 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_index_state_store.py :15 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_indexer.py :13 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_memory_records.py :15 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_secret_scan_cache.py :15 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_server_context_efficiency.py :6 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_server_tools.py :24 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_server_tools_lifecycle.py :19 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_server_tools_retrieval.py :19 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_storage_upgrade_resume.py :17 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_upgrade_wavefoundry.py :5360 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/vector_backend_eval.py :16 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/vector_public_eval.py :15 import sqlite3
db (weak) coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/upgrade_wavefoundry.py :852 import sqlite3 # local import — stdlib-only, keeps the upgrade module import-light

declared dependencies 36

mcp@*
packaging@>=24
fastembed@*
httpx@*
igraph@>=0.11
apsw@==3.53.4.0
sqlite-vec@==0.1.9
leidenalg@>=0.10
numpy@*
tree-sitter@>=0.24,<0.26
tree-sitter-typescript@*
tree-sitter-javascript@*

show 24 more

tree-sitter-go@*
tree-sitter-rust@*
tree-sitter-java@*
tree-sitter-c@*
tree-sitter-cpp@*
tree-sitter-c-sharp@*
tree-sitter-bash@*
tree-sitter-kotlin@*
tree-sitter-sql@*
tree-sitter-swift@*
tree-sitter-objc@*
tree-sitter-hcl@*
tree-sitter-scss@*
tree-sitter-make@*
tree-sitter-scala@*
tree-sitter-html@*
tree-sitter-xml@*
tree-sitter-ruby@*
tree-sitter-php@*
tree-sitter-yaml@*
tree-sitter-toml@*
tree-sitter-json@*
tree-sitter-css@*
tree-sitter-powershell@*

cursor-plugin 4

opaque (low) coryhacking-wavefoundry-884f46b/.cursor/hooks.json bundled .cursor/ plugin descriptor (coryhacking-wavefoundry-884f46b/.cursor/hooks.json) — presence-detected; review the descriptor
opaque (low) coryhacking-wavefoundry-884f46b/.cursor/hooks/after-file-edit.py bundled .cursor/ plugin descriptor (coryhacking-wavefoundry-884f46b/.cursor/hooks/after-file-edit.py) — presence-detected; review the descriptor
opaque (low) coryhacking-wavefoundry-884f46b/.cursor/mcp.json bundled .cursor/ plugin descriptor (coryhacking-wavefoundry-884f46b/.cursor/mcp.json) — presence-detected; review the descriptor
opaque (low) coryhacking-wavefoundry-884f46b/.cursor/rules/auto-guru.mdc bundled .cursor/ plugin descriptor (coryhacking-wavefoundry-884f46b/.cursor/rules/auto-guru.mdc) — presence-detected; review the descriptor