Self-hostable workflow orchestrator for teams whose main work isn't orchestration. Declarative YAML over your scripts, SSH commands, containers, etc; keep workflows separate from business logic. One binary, no database, runs on limited H/W resources. Alternative to Airflow / Cron / Job Scheduler.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport — counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 48e63aa · analyzer v33 · 53m ago
skills & prompt files 4
- agent-rules dagucloud-dagu-48e63aa/CLAUDE.md
- skill dagucloud-dagu-48e63aa/skills/dagu/SKILL.md
- agent-rules dagucloud-dagu-48e63aa/ui/.clinerules
- agent-rules dagucloud-dagu-48e63aa/ui/CLAUDE.md
danger signals3
- over-broad OAuth scope https://mail.google.com/ dagucloud-dagu-48e63aa/ui/src/i18n/staticMessages.ts :3717
'刷新令牌必须具有离线访问权限和 https://mail.google.com/ 范围。', - committed secret private key dagucloud-dagu-48e63aa/internal/testdata/certs/ca-key.pem :1
PEM private key block (redacted) - committed secret private key dagucloud-dagu-48e63aa/internal/testdata/certs/key.pem :1
PEM private key block (redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 2346
filesystem 8
- fs dagucloud-dagu-48e63aa/npm/dagu/install.js :8
const fs = require("fs"); - fs dagucloud-dagu-48e63aa/npm/dagu/lib/platform.js :7
const fs = require("fs"); - fs (weak) dagucloud-dagu-48e63aa/ui/e2e/dag-run-actions.spec.ts :5
import { writeFile } from 'node:fs/promises'; - fs (weak) dagucloud-dagu-48e63aa/ui/e2e/distributed-stack.spec.ts :6
import fs from 'node:fs/promises'; - fs (weak) dagucloud-dagu-48e63aa/ui/e2e/helpers/e2e.ts :6
import fs from 'node:fs/promises'; - fs (weak) dagucloud-dagu-48e63aa/ui/src/__tests__/webpack.prod.test.ts :4
import { readFileSync } from 'node:fs'; - fs (weak) dagucloud-dagu-48e63aa/ui/src/lib/__tests__/schema-utils.test.ts :1
import fs from 'node:fs'; - fs (weak) dagucloud-dagu-48e63aa/ui/src/styles/__tests__/global.test.ts :5
import { readFile } from 'node:fs/promises';
shell / exec 3
- shell dagucloud-dagu-48e63aa/npm/dagu/index.js :7
const childProcess = require("child_process"); - shell (weak) dagucloud-dagu-48e63aa/ui/e2e/distributed-stack.spec.ts :5
import { execFile as execFileCallback } from 'node:child_process'; - shell (weak) dagucloud-dagu-48e63aa/ui/e2e/helpers/e2e.ts :5
import { execFileSync } from 'node:child_process';
network 21
- net dagucloud-dagu-48e63aa/npm/dagu/install.js :11
const https = require("https"); - net (weak) dagucloud-dagu-48e63aa/ui/e2e/notification-channels.spec.ts :5
import { createServer } from 'node:http'; - net dagucloud-dagu-48e63aa/ui/src/api/v1/schema.ts :6743
/** @description page number of items to fetch (default is 1) */ - net dagucloud-dagu-48e63aa/ui/src/components/ChangePasswordModal.tsx :74
const response = await fetch(`${config.apiURL}/auth/change-password`, { - net dagucloud-dagu-48e63aa/ui/src/contexts/AuthContext.tsx :87
const response = await fetch(`${config.apiURL}/auth/me`, { - net dagucloud-dagu-48e63aa/ui/src/contexts/SchemaContext.tsx :42
const response = await fetch(SCHEMA_URL); - net dagucloud-dagu-48e63aa/ui/src/features/dags/components/dag-details/NotificationsTab.tsx :317
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/features/dags/components/dag-details/WebhookTab.tsx :180
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/features/dags/components/dag-details/notifications/useNotificationSettings.ts :66
const settingsRequest = fetch( - net dagucloud-dagu-48e63aa/ui/src/features/dags/components/dag-details/webhookProfileSelection.ts :133
await fetch('${webhookUrl}', { - net dagucloud-dagu-48e63aa/ui/src/hooks/SSEManager.ts :660
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/lib/download.ts :28
const response = await fetch(url, {
show 9 more
- net dagucloud-dagu-48e63aa/ui/src/lib/requestTimeout.ts :120
const response = await fetch(input, { - net dagucloud-dagu-48e63aa/ui/src/pages/api-keys/APIKeyFormModal.tsx :149
const response = await fetch(url, { - net dagucloud-dagu-48e63aa/ui/src/pages/api-keys/index.tsx :83
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/pages/audit-logs/index.tsx :415
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/pages/remote-nodes/index.tsx :73
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/pages/users/ResetPasswordModal.tsx :89
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/pages/users/UserFormModal.tsx :170
const response = await fetch(endpoint, { - net dagucloud-dagu-48e63aa/ui/src/pages/users/index.tsx :137
const response = await fetch( - net dagucloud-dagu-48e63aa/ui/src/pages/webhooks/index.tsx :124
const response = await fetch(
secrets 3
- secrets (weak) dagucloud-dagu-48e63aa/ui/e2e/helpers/e2e.ts :135
process.env.DAGU_LICENSE_KEY || - secrets (weak) dagucloud-dagu-48e63aa/ui/src/features/dags/components/dag-details/__tests__/webhookProfileSelection.test.ts :64
"crypto.createHmac('sha256', process.env.DAGU_HMAC_SECRET)" - secrets dagucloud-dagu-48e63aa/ui/src/features/dags/components/dag-details/webhookProfileSelection.ts :124
crypto.createHmac('sha256', process.env.DAGU_HMAC_SECRET)
install hooks 1
- postinstall dagucloud-dagu-48e63aa/npm/dagu/package.json :31
node ./install.js
declared dependencies 200
- github.com/modelcontextprotocol/go-sdk@v1.6.1
- @monaco-editor/react@4.7.0
- @radix-ui/react-checkbox@1.3.3
- @radix-ui/react-dialog@1.1.15
- @radix-ui/react-dropdown-menu@2.1.16
- @radix-ui/react-label@2.1.8
- @radix-ui/react-select@2.2.6
- @radix-ui/react-slot@1.2.4
- @radix-ui/react-switch@1.2.6
- @radix-ui/react-tabs@1.1.13
- @radix-ui/react-tooltip@1.2.8
- @rjsf/core@6.5.1
show 28 more
- @rjsf/shadcn@6.5.1
- @rjsf/utils@6.5.1
- @rjsf/validator-ajv8@6.5.1
- @scalar/api-reference-react@0.6.31
- @tanstack/react-table@8.21.3
- @types/node@24.1.0
- @xterm/addon-fit@0.11.0
- @xterm/addon-web-links@0.12.0
- @xterm/xterm@6.0.0
- class-variance-authority@0.7.1
- clsx@2.1.1
- cron-parser@5.3.1
- dayjs@1.11.20
- framer-motion@12.35.2
- lucide@0.525.0
- lucide-react@0.526.0
- mermaid@11.15.0
- monaco-editor@0.52.2
- monaco-yaml@5.4.1
- openapi-fetch@0.15.2
- prism-react-renderer@2.4.1
- react@19.1.6
- react-arborist@3.5.0
- react-cookie@8.0.1
- react-diff-viewer-continued@3.4.0
- react-dom@19.1.6
- react-markdown@10.1.0
- react-router-dom@7.13.2
160 more not shown — this panel samples each group; the count above is the real total.