github TypeScript re-analysis due

decoded-cipher/nodrix

The IoT platform Cloudflare didn't build. Telemetry, realtime dashboards, and automations on Workers + D1 + R2 + Durable Objects — in your own Cloudflare account.

maintainer: decoded-cipher
license: MIT
first seen: 2026-08-22
last seen: 2026-08-23
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 28 tools

transport — counts 28 tools · 0 res · 0 prompts permission surface via code analysis

tools

add_widget
create_automation
create_dashboard
create_integration
create_project
create_variable
emit_event
get_dashboard
get_series
get_state
list_automations
list_block_types
list_dashboards
list_integration_kinds
list_integrations
list_projects
list_variables
list_widget_types
list_widgets
run_automation
set_variable
test_integration
update_automation
update_dashboard
update_integration
update_project
update_variable
update_widget

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit cfd7abb · analyzer v33 · 1w ago

danger signals6

suspicious endpoint api.telegram.org decoded-cipher-nodrix-cfd7abb/shared/integrations/telegram/run.ts :18 return doFetch(`https://api.telegram.org/bot${token}/sendMessage`, {
suspicious endpoint api.telegram.org decoded-cipher-nodrix-cfd7abb/worker/test/integrations.test.ts :15 expect(unsafeUrlReason('https://api.telegram.org/botTOKEN/sendMessage')).toBeNull();
suspicious endpoint 8.8.8.8 decoded-cipher-nodrix-cfd7abb/worker/test/integrations.test.ts :17 expect(unsafeUrlReason('http://8.8.8.8/x')).toBeNull(); // public IP
suspicious endpoint 11.0.0.1 decoded-cipher-nodrix-cfd7abb/worker/test/integrations.test.ts :18 expect(unsafeUrlReason('http://11.0.0.1/x')).toBeNull(); // 11/8 is public
suspicious endpoint 172.32.0.1 decoded-cipher-nodrix-cfd7abb/worker/test/integrations.test.ts :19 expect(unsafeUrlReason('http://172.32.0.1/x')).toBeNull(); // outside 172.16/12
suspicious endpoint 169.254.169.254 (cloud metadata) decoded-cipher-nodrix-cfd7abb/worker/test/integrations.test.ts :38 'http://169.254.169.254/latest/meta-data/', // cloud metadata

code evidence vv1.0.1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 177

filesystem 3

fs (weak) decoded-cipher-nodrix-cfd7abb/scripts/gen-migrations.ts :8 import { readdirSync, readFileSync, writeFileSync } from 'node:fs';
fs (weak) decoded-cipher-nodrix-cfd7abb/scripts/gen-version.ts :18 import { readFileSync, writeFileSync } from 'node:fs';
fs (weak) decoded-cipher-nodrix-cfd7abb/scripts/merge-wrangler.ts :8 import { readFileSync } from 'node:fs';

shell / exec 2

shell (weak) decoded-cipher-nodrix-cfd7abb/scripts/gen-version.ts :17 import { spawnSync } from 'node:child_process';
shell decoded-cipher-nodrix-cfd7abb/worker/src/platform/db/auto-migrate.ts :5 // part-way leaves the database untouched. exec() — which D1's migration docs

network 17

net decoded-cipher-nodrix-cfd7abb/shared/integrations/lib.ts :11 const res = await fetch(url, { ...init, signal: AbortSignal.timeout(TIMEOUT_MS) });
net decoded-cipher-nodrix-cfd7abb/web/src/api.ts :32 const res = await fetch(path, {
net decoded-cipher-nodrix-cfd7abb/web/src/lib/public-api.ts :17 const res = await fetch(path, { headers: { accept: 'application/json' } });
net decoded-cipher-nodrix-cfd7abb/web/src/stores/project.ts :95 const res = await fetch(`/v1/admin/projects/${pid}/firmware?${q}`, {
net decoded-cipher-nodrix-cfd7abb/worker/src/domains/dashboards/seo.ts :41 const res = await env.ASSETS.fetch(req); // SPA fallback → index.html
net decoded-cipher-nodrix-cfd7abb/worker/src/domains/dashboards/ws.ts :41 return dashboardStub(c.env, dashId).fetch(fwd);
net decoded-cipher-nodrix-cfd7abb/worker/src/domains/firmware/agent.ts :51 return stub.fetch(
net decoded-cipher-nodrix-cfd7abb/worker/src/domains/firmware/service.ts :38 res = await fetch(`https://api.github.com/repos/${SDK_REPO}/releases/latest`, { headers });
net decoded-cipher-nodrix-cfd7abb/worker/src/domains/settings/version.ts :117 const res = await fetch(url, { headers });
net decoded-cipher-nodrix-cfd7abb/worker/src/domains/telemetry/control.ts :62 return stub.fetch(c.req.raw);
net decoded-cipher-nodrix-cfd7abb/worker/src/index.ts :33 return oauthMcpHandler.fetch(request, env, ctx);
net decoded-cipher-nodrix-cfd7abb/worker/src/mcp/gate.ts :57 return mcpHandler.fetch(c.req.raw, c.env, c.executionCtx);
net decoded-cipher-nodrix-cfd7abb/worker/src/platform/durable-objects/dashboard-do.ts :65 override async fetch(request: Request): Promise<Response> {
net decoded-cipher-nodrix-cfd7abb/worker/src/platform/durable-objects/project-do.ts :579 override async fetch(request: Request): Promise<Response> {
net decoded-cipher-nodrix-cfd7abb/worker/src/platform/lib/usage-stats.ts :83 await fetch(url, {
net decoded-cipher-nodrix-cfd7abb/worker/src/routes.ts :107 app.all('*', async (c) => c.env.ASSETS.fetch(c.req.raw));
net (weak) decoded-cipher-nodrix-cfd7abb/worker/test/smoke.ts :27 const res = await fetch(`${BASE}${path}`, {

tool registrations 28

list_projects decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :43
list_variables decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :61
get_state decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :75
get_series decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :89
list_dashboards decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :113
get_dashboard decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :127
list_widget_types decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :141
list_widgets decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :152
list_block_types decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :174
list_integration_kinds decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :193
list_automations decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :223
list_integrations decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-read.ts :237
create_project decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :32
update_project decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :38
create_variable decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :48
update_variable decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :57
set_variable decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :66
create_dashboard decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :88
update_dashboard decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :97
add_widget decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :126
update_widget decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :163
create_automation decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :210
update_automation decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :245
run_automation decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :276
emit_event decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :285
create_integration decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :303
update_integration decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :328
test_integration decoded-cipher-nodrix-cfd7abb/worker/src/mcp/tools-write.ts :352

install hooks 1

postinstall decoded-cipher-nodrix-cfd7abb/package.json :20 bun run build:version

declared dependencies 1

typescript@^5.6.3