Self-hosted Agent Protocol control plane. Framework-agnostic runners, embedded Admin (ops + SQL governance), pluggable Postgres/Redis HA, connector policy and audit.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit f6b0b75 · analyzer v33 · 2d ago
skills & prompt files 1
danger signals2
- dynamic code execution eval() getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/factoryGraph.test.ts :42
const bareArrow = eval("x => x") as (x: unknown) => unknown; - committed secret private key getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/tls.test.ts :41
PEM private key block (redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 637
filesystem 9
- fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/adapter.js :18
import { readFileSync } from "node:fs"; - fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/proto.js :11
import { existsSync } from "node:fs"; - fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/tls.js :39
import { readFileSync } from "node:fs"; - fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/worker.js :10
import { readFileSync } from "node:fs"; - fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/adapter.ts :18
import { readFileSync } from "node:fs"; - fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/proto.ts :11
import { existsSync } from "node:fs"; - fs (weak) getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/tls.test.ts :8
import { mkdtempSync, writeFileSync, rmSync } from "node:fs"; - fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/tls.ts :39
import { readFileSync } from "node:fs"; - fs getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/worker.ts :10
import { readFileSync } from "node:fs";
network 23
- net getrunkite-runkite-f6b0b75/admin-ui/src/api/client.ts :60
const resp = await fetch(`${BASE}${path}`, { - net getrunkite-runkite-f6b0b75/admin-ui/src/api/sse.ts :19
fetch(`/admin-api${path}`, { - net getrunkite-runkite-f6b0b75/bench/soak/load_js.mjs :33
const create = await fetch(`${URL}/threads/${threadId}/runs`, { - net (weak) getrunkite-runkite-f6b0b75/examples/gemini/dogfood/ui/app.js :131
const res = await fetch(`${CP}/threads`, { - net (weak) getrunkite-runkite-f6b0b75/examples/gemini/dogfood/ui/hub.js :228
const res = await fetch("/qa-matrix.json"); - net getrunkite-runkite-f6b0b75/internal/adminui/dist/assets/index-D0tlg1jO.js :1
n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();var u=o((e=>{var t=Symbol.for(`react.transitional.element`),n=Symbol.for(`react.portal`),r=Symbol.for(`react.fragment`),i=Symbol.for(`react - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/a2a.js :96
const resp = await fetch(`${baseUrl}/internal/a2a/runs`, fetchOpts); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/connectors.js :59
const resp = await fetch(`${baseUrl(opts.controlPlaneUrl)}/internal/connectors/${encodeURIComponent(name)}/session`, init); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/customApp.js :15
import { createServer } from "node:http"; - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/proxyCheckpoint.js :183
const put = await fetch(this.url(threadId, key), init); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/runStatus.js :25
const resp = await fetch(`${base}/internal/runs/${runId}/status`, init); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/store.js :197
const resp = await fetch(url, opts);
show 11 more
- net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/tls.js :41
import { Agent } from "undici"; - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/vectorstore.js :114
const resp = await fetch(`${this.baseUrl}/internal/vectors/items`, opts); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/a2a.ts :119
const resp = await fetch(`${baseUrl}/internal/a2a/runs`, fetchOpts); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/connectors.ts :74
const resp = await fetch( - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/customApp.ts :15
import { createServer, type RequestListener, type Server } from "node:http"; - net (weak) getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/proxyCheckpoint.test.ts :12
import http from "node:http"; - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/proxyCheckpoint.ts :212
const put = await fetch(this.url(threadId, key), init); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/runStatus.ts :33
const resp = await fetch(`${base}/internal/runs/${runId}/status`, init); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/store.ts :238
const resp = await fetch(url, opts); - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/tls.ts :41
import { Agent } from "undici"; - net getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/vectorstore.ts :155
const resp = await fetch(`${this.baseUrl}/internal/vectors/items`, opts);
secrets 8
- secrets (weak) getrunkite-runkite-f6b0b75/examples/gemini/langgraphjs_agent/graph.ts :27
apiKey: process.env.GOOGLE_API_KEY, - secrets getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/a2a.js :83
const runnerToken = process.env.RUNNER_TOKEN; - secrets getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/connectors.js :36
const runnerToken = process.env.RUNNER_TOKEN; - secrets getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/worker.js :151
const runnerToken = process.env.RUNNER_TOKEN ?? ""; - secrets (weak) getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/a2a.test.ts :39
const originalToken = process.env.RUNNER_TOKEN; - secrets getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/a2a.ts :105
const runnerToken = process.env.RUNNER_TOKEN; - secrets getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/connectors.ts :46
const runnerToken = process.env.RUNNER_TOKEN; - secrets getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/worker.ts :187
const runnerToken = process.env.RUNNER_TOKEN ?? "";
database 2
- db getrunkite-runkite-f6b0b75/typescript/runkite-runner/dist/store.js :24
import pg from "pg"; - db getrunkite-runkite-f6b0b75/typescript/runkite-runner/src/store.ts :34
import pg from "pg";
install hooks 1
- prepublishOnly getrunkite-runkite-f6b0b75/typescript/runkite-runner/package.json :19
npm run build
declared dependencies 110
- github.com/modelcontextprotocol/go-sdk@v1.7.0
- @radix-ui/react-avatar@^1.2.6
- @radix-ui/react-dialog@^1.1.23
- @radix-ui/react-dropdown-menu@^2.1.24
- @radix-ui/react-label@^2.1.15
- @radix-ui/react-popover@^1.1.23
- @radix-ui/react-scroll-area@^1.2.18
- @radix-ui/react-select@^2.3.7
- @radix-ui/react-separator@^1.1.15
- @radix-ui/react-slot@^1.3.3
- @radix-ui/react-tabs@^1.1.21
- @radix-ui/react-tooltip@^1.2.16
show 28 more
- @tanstack/react-table@^8.21.3
- class-variance-authority@^0.7.1
- clsx@^2.1.1
- cmdk@^1.1.1
- lucide-react@^1.28.0
- react@^19.2.7
- react-dom@^19.2.7
- react-router@^8.3.0
- recharts@^3.10.1
- sonner@^2.0.7
- tailwind-merge@^3.6.0
- tw-animate-css@^1.4.0
- @tailwindcss/vite@^4.3.3
- @types/node@^24.13.2
- @types/react@^19.2.17
- @types/react-dom@^19.2.3
- @vitejs/plugin-react@^6.0.3
- oxlint@^1.71.0
- tailwindcss@^4.3.3
- typescript@~6.0.2
- vite@^8.2.1
- github.com/MicahParks/keyfunc/v3@v3.8.0
- github.com/coder/websocket@v1.8.15
- github.com/go-sql-driver/mysql@v1.10.0
- github.com/golang-jwt/jwt/v5@v5.3.1
- github.com/google/uuid@v1.6.0
- github.com/hashicorp/golang-lru/v2@v2.0.7
- github.com/jackc/pgx/v5@v5.10.0
70 more not shown — this panel samples each group; the count above is the real total.