MCP Observatory
2m ago Tracked 59,469 Last 2m ago 24h 2,466
github analyzed 3ee2d83 deep scan unknown

frumu-ai/tandem

github

Remote MCP server for Tandem docs, install guides, SDKs, workflows, and agent setup help.

maintainer
frumu-ai
licence
—
first seen
2026-06-03
last seen
2026-06-03
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 3ee2d83 · analyzer v33 · 1w ago

skills & prompt files 40

danger signals3

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1985

filesystem 92

  • fs (weak) frumu-ai-tandem-3ee2d83/examples/email-approval-demo/demo.mjs :6 import { createWriteStream, existsSync } from "node:fs";
  • fs (weak) frumu-ai-tandem-3ee2d83/examples/email-approval-demo/stub-email-mcp.mjs :4 import { mkdir, appendFile } from "node:fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/guide/scripts/write-docs-build-metadata.mjs :1 import { mkdir, readFile, writeFile } from "node:fs/promises"
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/index.js :3 import { cp, mkdir, readFile, readdir, stat, writeFile } from "fs/promises";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/bin/setup.js :5 import { readFileSync, existsSync, createReadStream, createWriteStream } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/bootstrap.js :1 import { existsSync, readFileSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/doctor.js :1 import { existsSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/env.js :1 import { existsSync, readFileSync, writeFileSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/services/common.js :2 import { existsSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/services/launchd.js :1 import { mkdir, writeFile } from "fs/promises";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/services/systemd.js :1 import { writeFile } from "fs/promises";
  • fs frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/server/routes/swarm.js :1 import { readFile, readdir, stat } from "fs/promises";
show 28 more
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/tests/scaffold.test.mjs :3 import { mkdtemp, readFile } from "fs/promises";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-ai/bin/tandem.js :3 const fs = require('fs');
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-client-ts/test/events.test.ts :1 import { readFileSync } from "node:fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/docker-token.js :17 } from "node:fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/setup.js :5 import { readFileSync, existsSync, createReadStream, createWriteStream } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/bootstrap.js :1 import { existsSync, readFileSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/control-panel-config.js :1 import { existsSync, readFileSync, writeFileSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/control-panel-preferences.js :1 import { existsSync, readFileSync, writeFileSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/doctor.js :1 import { existsSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/env.js :1 import { existsSync, readFileSync, writeFileSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/services/common.js :2 import { existsSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/services/launchd.js :1 import { mkdir, writeFile } from "fs/promises";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/services/systemd.js :1 import { writeFile } from "fs/promises";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/aca.js :1 import { existsSync } from "fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/knowledgebase.js :1 import { readFileSync } from "node:fs";
  • fs frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/swarm.js :1 import { readFile, readdir, stat } from "fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/aca-proxy.test.mjs :3 import { mkdtemp, rm } from "node:fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/automation-webhook-manager.test.mjs :2 import { readFileSync } from "node:fs";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/automation-wizard-errors.test.mjs :2 import { readFileSync } from "node:fs";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/automation-wizard-progress.test.mjs :2 import { readFileSync } from "node:fs";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/capabilities-integration.test.mjs :3 import { mkdtemp, writeFile, rm } from "node:fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/docker-token.test.mjs :2 import { lstatSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/doctor.test.mjs :2 import { mkdtemp, writeFile } from "node:fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/hosted-session-integration.test.mjs :3 import { mkdtemp, writeFile, rm } from "node:fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/hosted-session.test.mjs :3 import { readFile } from "node:fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/icon-registry.test.mjs :2 import { readFileSync, readdirSync } from "node:fs";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/knowledgebase-proxy.test.mjs :3 import { mkdtemp, writeFile } from "node:fs/promises";
  • fs (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/mission-builder-prompt.test.mjs :2 import { readFileSync } from "node:fs";

52 more not shown — this panel samples each group; the count above is the real total.

shell / exec 45

  • shell (weak) frumu-ai-tandem-3ee2d83/examples/email-approval-demo/demo.mjs :5 import { spawn } from "node:child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/bin/cli.js :4 import { spawn } from "child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/bin/service-runner.js :3 import { spawn } from "child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/bin/setup.js :3 import { spawn } from "child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/common.js :1 import { spawn } from "child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/scripts/dev.js :3 import { spawn } from "child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/tests/scaffold.test.mjs :6 import { spawn } from "child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-ai/bin/tandem.js :6 const { spawn, execSync } = require('child_process');
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-client-ts/src/client.ts :4766 async spawn(input: AgentTeamSpawnInput): Promise<AgentTeamSpawnResponse> {
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/cli.js :4 import { spawn } from "child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/docker-up.js :3 import { spawnSync } from "node:child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/service-runner.js :3 import { spawn } from "child_process";
show 28 more
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/setup.js :3 import { spawn } from "child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/common.js :1 import { spawn } from "child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/aca-proxy.test.mjs :2 import { spawn } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/capabilities-integration.test.mjs :2 import { spawn } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/engine-proxy-header-strip.test.mjs :2 import { spawn } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/hosted-session-integration.test.mjs :2 import { spawn } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/knowledgebase-proxy.test.mjs :6 import { spawn } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/smoke.test.mjs :2 import { spawn } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/workspace-files.test.mjs :2 import { spawn } from "node:child_process";
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-engine/bin/tandem-engine.js :5 const { spawnSync } = require("child_process");
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-engine/bin/tandem.js :6 const { spawn } = require("child_process");
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-engine/scripts/binary-installer.js :4 const { execFileSync, execSync } = require("child_process");
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-enterprise/bin/tandem-engine.js :5 const { spawnSync } = require("child_process");
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-enterprise/scripts/binary-installer.js :4 const { execFileSync, execSync } = require("child_process");
  • shell frumu-ai-tandem-3ee2d83/packages/tandem-tui/bin/tandem-tui.js :5 const { spawnSync } = require("child_process");
  • shell (weak) frumu-ai-tandem-3ee2d83/packages/tandem-tui/scripts/install.js :4 const { execSync } = require('child_process');
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/audit-javascript-workspaces.mjs :5 import { spawnSync } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/bench-js/bench_e2e.mjs :1 import { spawn } from 'child_process';
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/bench-js/bench_fs_tandem.mjs :2 import { spawn } from 'child_process';
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/bench-js/bench_server.mjs :3 import { spawn } from 'child_process';
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/bench-js/bench_server_features.mjs :1 import { spawn } from 'child_process';
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/check-dco.mjs :19 import { spawnSync } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/check-incident-monitor-terminology.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/ci-engine-pin-scope.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/ci-release-candidate.mjs :5 import { execFileSync } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/ci-release-candidate.test.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/download-sidecar.js :174 const { execSync } = await import("child_process");
  • shell (weak) frumu-ai-tandem-3ee2d83/scripts/extract-release-notes.js :16 import { execSync } from 'node:child_process';

5 more not shown — this panel samples each group; the count above is the real total.

network 53

  • net frumu-ai-tandem-3ee2d83/apps/tandem-desktop/src/App.tsx :255 const response = await globalThis.fetch(
  • net frumu-ai-tandem-3ee2d83/apps/tandem-desktop/src/components/settings/Settings.tsx :451 const response = await globalThis.fetch(
  • net (weak) frumu-ai-tandem-3ee2d83/examples/email-approval-demo/demo.mjs :8 import net from "node:net";
  • net (weak) frumu-ai-tandem-3ee2d83/examples/email-approval-demo/stub-email-mcp.mjs :3 import http from "node:http";
  • net frumu-ai-tandem-3ee2d83/guide/book/book-a0b12cfe.js :25 fetch(url, options),
  • net frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/bin/setup.js :4 import { createServer } from "http";
  • net frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/lib/setup/doctor.js :24 const res = await fetch(`${bootstrap.engineUrl}/global/health`, {
  • net frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/server/routes/swarm.js :775 const response = await fetch(engineProbeUrl, {
  • net frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/src/lib/api.ts :2 const res = await fetch(path, {
  • net frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/src/pages/ChatPage.tsx :734 const res = await fetch(`/api/engine/session/${encodeURIComponent(sessionId)}/run`, {
  • net frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/src/pages/McpPage.tsx :621 const res = await fetch(
  • net frumu-ai-tandem-3ee2d83/packages/tandem-ai/bin/tandem.js :5 const https = require('https');
show 28 more
  • net frumu-ai-tandem-3ee2d83/packages/tandem-client-ts/src/client.ts :571 res = await fetch(`${this.baseUrl}${path}`, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-client-ts/src/stream.ts :192 response = await fetch(url, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/setup.js :4 import { createServer } from "http";
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/lib/setup/doctor.js :25 const res = await fetch(`${bootstrap.engineUrl}/global/health`, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/aca.js :224 const res = await fetch(`${baseUrl}/operator/feedback`, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/capabilities.js :76 const res = await fetch(target, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/control-panel-config.js :36 const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/health`, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/knowledgebase.js :77 const upstream = await fetch(`${baseUrl}/admin/collections`, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/server/routes/swarm.js :807 const response = await fetch(engineProbeUrl, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/src/features/knowledgebase/KnowledgebaseUploadPanel.tsx :907 const response = await fetch(
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/src/lib/api.ts :67 res = await fetch(path, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/src/pages/ChatPage.tsx :650 const res = await fetch(`/api/engine/session/${encodeURIComponent(sessionId)}/run`, {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/src/pages/McpPage.tsx :1064 const res = await fetch(
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/src/pages/PacksPage.tsx :179 const response = await fetch(packFileUrl(activePackId, "README.md"), {
  • net frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/src/services/sse.js :111 const response = await fetch(url, {
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/aca-proxy.test.mjs :4 import { createServer } from "node:http";
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/capabilities-integration.test.mjs :4 import { createServer } from "node:http";
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/capabilities.test.mjs :3 import { createServer } from "node:http";
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/engine-proxy-header-strip.test.mjs :3 import { createServer } from "node:http";
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/hosted-session-integration.test.mjs :4 import { createServer } from "node:http";
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/knowledgebase-proxy.test.mjs :2 import { createServer } from "node:http";
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/smoke.test.mjs :3 import { createServer } from "node:http";
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/workspace-files.test.mjs :4 import { createServer } from "node:http";
  • net frumu-ai-tandem-3ee2d83/packages/tandem-engine/bin/tandem-engine.js :4 const https = require("https");
  • net frumu-ai-tandem-3ee2d83/packages/tandem-engine/bin/tandem.js :427 const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-engine/scripts/binary-installer.js :3 const https = require("https");
  • net frumu-ai-tandem-3ee2d83/packages/tandem-enterprise/bin/tandem-engine.js :4 const https = require("https");
  • net (weak) frumu-ai-tandem-3ee2d83/packages/tandem-enterprise/scripts/binary-installer.js :3 const https = require("https");

13 more not shown — this panel samples each group; the count above is the real total.

secrets 11

  • secrets frumu-ai-tandem-3ee2d83/packages/create-tandem-panel/template/bin/setup.js :206 process.env.TANDEM_CONTROL_PANEL_ENGINE_TOKEN ||
  • secrets frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/bin/setup.js :268 process.env.TANDEM_CONTROL_PANEL_ENGINE_TOKEN || process.env.TANDEM_API_TOKEN || ""
  • secrets (weak) frumu-ai-tandem-3ee2d83/packages/tandem-engine/scripts/binary-installer.js :54 const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets (weak) frumu-ai-tandem-3ee2d83/packages/tandem-enterprise/scripts/binary-installer.js :54 const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets (weak) frumu-ai-tandem-3ee2d83/packages/tandem-tui/scripts/install.js :50 const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets (weak) frumu-ai-tandem-3ee2d83/scripts/bench-js/bench_e2e.mjs :65 process.env.BENCH_API_KEY ||
  • secrets (weak) frumu-ai-tandem-3ee2d83/scripts/bench-js/bench_server_features.mjs :32 const TOKEN = (process.env.BENCH_TOKEN || '').trim();
  • secrets (weak) frumu-ai-tandem-3ee2d83/scripts/download-sidecar.js :27 const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
  • secrets (weak) frumu-ai-tandem-3ee2d83/scripts/incident-monitor-external-log-intake-smoke.mjs :16 const token = process.env.TANDEM_TOKEN || "";
  • secrets (weak) frumu-ai-tandem-3ee2d83/scripts/loadtest/run_concurrency.mjs :4 const TOKEN = process.env.TANDEM_TOKEN || "";
  • secrets (weak) frumu-ai-tandem-3ee2d83/scripts/loadtest/run_fanout.mjs :4 const TOKEN = process.env.TANDEM_TOKEN || "";

install hooks 5

  • prepublishOnly frumu-ai-tandem-3ee2d83/packages/tandem-client-ts/package.json :21 npm run build
  • prepublishOnly frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/package.json :28 npm run build
  • postinstall frumu-ai-tandem-3ee2d83/packages/tandem-engine/package.json :11 node scripts/install.js
  • postinstall frumu-ai-tandem-3ee2d83/packages/tandem-enterprise/package.json :10 node scripts/install.js
  • postinstall frumu-ai-tandem-3ee2d83/packages/tandem-tui/package.json :10 node scripts/install.js

declared dependencies 3

  • husky@^9.1.7
  • lint-staged@^16.4.0
  • prettier@^3.8.1

obfuscation 1

  • dynamic require()/import() frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/orchestration-studio-model.test.mjs :29 moduleNames.map((name) => [name, require(join(directory, `${name}.js`))])

perm:untrusted 1

  • untrusted (weak) frumu-ai-tandem-3ee2d83/packages/tandem-control-panel/tests/hosted-session-integration.test.mjs :201 const before = await (await fetch(configUrl, { headers })).json();