github Python analyzed 884f46b deep scan · partial (90/2,545 files)

coryhacking/wavefoundry

Wave-based development lifecycle and code intelligence framework for AI-assisted engineering. Includes semantic + graph indexing, MCP tool surface, built-in secrets detection with lifecycle gates, and a local dashboard for inspecting project health, active work, and diffs.

maintainer: coryhacking
licence: Apache-2.0
first seen: 2026-06-06
last seen: 2026-09-10
releases · 30d: 11
short id

risk 45/100 · heuristic grade

C elevated inferred analyzer v33 (current)

capability exposure inferred + 16
recent drift inferred + 20
tool safety inferred + 12
trust mitigators mixed − 3

inferred mixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

grade last moved 3d ago · see ecosystem CVEs →

risk trajectory 3 movements

9w ago D · 63 → C · 45
9w ago C · 51 → D · 63
12w ago C · 43 → C · 51

capability exposure grade factor +16

Inferred surface — each links to servers holding it:

vulnerabilities 0 CVEs

No known CVEs for this server.

tool safety 1 findings · grade factor +12

high dangerous code

committed secret: Google API key, Stripe live key · dynamic exec: __import__(), eval()/exec()

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 884f46b · analyzer v33 · 3h ago

skills & prompt files 166

danger signals8

dynamic code execution __import__() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/chunker.py :50 mod = __import__(module_name, fromlist=[lang_fn])
dynamic code execution __import__() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_graph_indexer.py :3706 __import__(lang_skip_mod)
dynamic code execution eval()/exec() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_render_platform_surfaces.py :1694 exec(compile(self.mod.HOOK_BOOTSTRAP, "<bootstrap>", "exec"), ns) # must not raise
dynamic code execution eval()/exec() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_upgrade_wavefoundry.py :424 exec(compile(source, "<test>", "exec"), m.__dict__)
dynamic code execution __import__() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_venv_bootstrap.py :121 mod = __import__(unique) # would ImportError if addsitedir didn't make sp live
dynamic code execution eval()/exec() coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/upgrade_wavefoundry.py :1127 exec(compile(source, candidate, "exec"), mod.__dict__)
committed secret Google API key coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scan-rules.toml :1502 AIzaSy…(39 chars, redacted)
committed secret Stripe live key coryhacking-wavefoundry-884f46b/.wavefoundry/framework/scripts/tests/test_secrets_validators.py :921 sk_liv…(40 chars, redacted)

other grade factors evidence elsewhere

recent drift +20 capability drift →

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:coryhacking/wavefoundry/badge.svg)](https://mcpobservatory.com/servers/github:coryhacking/wavefoundry/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of coryhacking.

coryhacking/wavefoundry

skills & prompt files 166

danger signals8

Navigate

Stream

Features

Display