github TypeScript analyzed dc148c5

githits-com/githits-cli

github

CLI & MCP for GitHits - The Code Context Layer for AI Coding Agents

maintainer
githits-com
licence
Apache-2.0
first seen
2026-07-01
last seen
2026-09-15
releases · 30d
41
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in githits-com/githits-cli
  2. HIGH code analysis flagged committed secret in githits-com/githits-cli
  3. HIGH code analysis flagged committed secret in githits-com/githits-cli
  4. HIGH code analysis flagged committed secret in githits-com/githits-cli
  5. HIGH code analysis flagged committed secret in githits-com/githits-cli
  6. HIGH code analysis flagged committed secret in githits-com/githits-cli
  7. HIGH code analysis flagged committed secret in githits-com/githits-cli
  8. HIGH code analysis flagged committed secret in githits-com/githits-cli
  9. HIGH code analysis flagged committed secret in githits-com/githits-cli
  10. HIGH code analysis flagged committed secret in githits-com/githits-cli
  11. HIGH code analysis flagged committed secret in githits-com/githits-cli
  12. HIGH code analysis flagged committed secret in githits-com/githits-cli
  13. HIGH code analysis flagged committed secret in githits-com/githits-cli
  14. HIGH code analysis flagged committed secret in githits-com/githits-cli
  15. HIGH code analysis flagged committed secret in githits-com/githits-cli
  16. HIGH code analysis flagged committed secret in githits-com/githits-cli
  17. HIGH code analysis flagged committed secret in githits-com/githits-cli
  18. HIGH code analysis flagged committed secret in githits-com/githits-cli
  19. HIGH code analysis flagged committed secret in githits-com/githits-cli
  20. HIGH code analysis flagged committed secret in githits-com/githits-cli
capabilities 5 tools
transport stdio · streamable-http · http counts 5 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • pkg_changelog
  • pkg_info
  • pkg_vulns
  • quick_start
  • read
skills & danger signals github-tarball
code evidence vv0.17.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 472

filesystem 63

  • fs githits-com-githits-cli-dc148c5/bunup.config.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs githits-com-githits-cli-dc148c5/eval/agentic/context-loading/prepare-luna.ts :1 import { mkdir, readFile, writeFile } from "node:fs/promises";
  • fs githits-com-githits-cli-dc148c5/eval/agentic/context-loading/prepare-routing.ts :2 import { mkdir, readFile, writeFile } from "node:fs/promises";
  • fs githits-com-githits-cli-dc148c5/eval/agentic/context-loading/prepare.ts :2 import { mkdir, readFile, writeFile } from "node:fs/promises";
  • fs githits-com-githits-cli-dc148c5/eval/agentic/context-loading/summarize-pr.ts :1 import { readFile } from "node:fs/promises";
  • fs githits-com-githits-cli-dc148c5/eval/drivers/claude-cli.ts :27 import { mkdtempSync, writeFileSync } from "node:fs";
  • fs githits-com-githits-cli-dc148c5/eval/mock-mcp/server.ts :26 import { readFileSync } from "node:fs";
  • fs githits-com-githits-cli-dc148c5/eval/mock-mcp/state.ts :11 import { readFileSync, writeFileSync } from "node:fs";
  • fs githits-com-githits-cli-dc148c5/eval/run-pass3.ts :23 import { mkdtempSync } from "node:fs";
  • fs githits-com-githits-cli-dc148c5/eval/run.ts :15 import { mkdtempSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/eval/security-eval.test.ts :2 import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
  • fs githits-com-githits-cli-dc148c5/eval/skills-workspace.ts :8 } from "node:fs";
show 28 more
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-context-load.test.ts :2 import { mkdtemp, rm, writeFile } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-context-load.ts :2 import { readFile } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval-braintrust.test.ts :10 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval-braintrust.ts :8 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval-ci-report.test.ts :9 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval-ci-report.ts :1 import { mkdirSync, writeFileSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval-report.ts :1 import { existsSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval-suite.test.ts :11 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval-suite.ts :10 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval.test.ts :11 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval.ts :15 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/agent-session.ts :8 } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/generate-plugin-assets.test.ts :2 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/generate-plugin-assets.ts :1 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/pkg-ecosystem-audit.ts :2 import { mkdirSync, writeFileSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/publish-npm.ts :1 import { readFile } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/run-proxy-node-smoke.ts :2 import { mkdtemp, rm, writeFile } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/smoke-environment.test.ts :2 import { existsSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/smoke-environment.ts :1 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/smoke-launch-target.test.ts :2 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/smoke-launch-target.ts :1 import { statSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/smoke-scripts.test.ts :2 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/validate-public-packages.test.ts :2 import { mkdtemp, rm, writeFile } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/scripts/validate-public-packages.ts :9 } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/src/cli/errors.test.ts :2 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) githits-com-githits-cli-dc148c5/src/cli/experimental-tools.test.ts :2 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
  • fs githits-com-githits-cli-dc148c5/src/commands/doctor.ts :1 import { realpath } from "node:fs/promises";
  • fs (weak) githits-com-githits-cli-dc148c5/src/commands/init/init.test.ts :10 import { mkdtempSync, readFileSync } from "node:fs";

23 more not shown — this panel samples each group; the count above is the real total.

shell / exec 14

  • shell githits-com-githits-cli-dc148c5/eval/run-process.ts :29 const proc = Bun.spawn([...opts.cmd], {
  • shell (weak) githits-com-githits-cli-dc148c5/eval/security-eval.test.ts :172 const proc = Bun.spawn(
  • shell (weak) githits-com-githits-cli-dc148c5/scripts/agent-context-load.test.ts :115 const child = Bun.spawn(
  • shell (weak) githits-com-githits-cli-dc148c5/scripts/agent-eval.ts :1344 const proc = Bun.spawn([command, ...args], {
  • shell (weak) githits-com-githits-cli-dc148c5/scripts/cli-smoke.ts :694 const proc = Bun.spawn(appendCliArgs(cliLaunchTarget, args), {
  • shell (weak) githits-com-githits-cli-dc148c5/scripts/pkg-ecosystem-audit.ts :1 import { spawn } from "node:child_process";
  • shell (weak) githits-com-githits-cli-dc148c5/scripts/publish-npm.ts :118 const child = Bun.spawn(["npm", "publish", "--access", "public"], {
  • shell (weak) githits-com-githits-cli-dc148c5/scripts/run-proxy-node-smoke.ts :1 import { spawnSync } from "node:child_process";
  • shell (weak) githits-com-githits-cli-dc148c5/scripts/validate-public-packages.ts :408 const process = Bun.spawn(
  • shell (weak) githits-com-githits-cli-dc148c5/src/cli/errors.test.ts :250 const proc = Bun.spawn(
  • shell (weak) githits-com-githits-cli-dc148c5/src/cli/experimental-tools.test.ts :39 const child = Bun.spawn(["bun", "run", "src/cli.ts", ...args], {
  • shell githits-com-githits-cli-dc148c5/src/services/exec-service.ts :1 import { spawn } from "node:child_process";
show 2 more
  • shell (weak) githits-com-githits-cli-dc148c5/src/services/locked-auth-storage.test.ts :2 import { spawn } from "node:child_process";
  • shell githits-com-githits-cli-dc148c5/src/services/locked-auth-storage.ts :2 import { execFile } from "node:child_process";

network 6

  • net (weak) githits-com-githits-cli-dc148c5/eval/fixtures/legit-signals.ts :254 4 return fetch(\`\${API_ENDPOINT}/widgets/\${id}\`);
  • net (weak) githits-com-githits-cli-dc148c5/scripts/proxy-node-smoke.mjs :1 import { createServer } from "node:http";
  • net (weak) githits-com-githits-cli-dc148c5/scripts/publish-npm.ts :27 fetch: (url, options): Promise<Response> => fetch(url, options),
  • net (weak) githits-com-githits-cli-dc148c5/src/services/auth-service.test.ts :3 import { createServer, ServerResponse } from "node:http";
  • net githits-com-githits-cli-dc148c5/src/services/auth-service.ts :1 import { createServer, type Server, type ServerResponse } from "node:http";
  • net githits-com-githits-cli-dc148c5/src/services/proxy-fetch.ts :1 import { type Dispatcher, ProxyAgent, fetch as undiciFetch } from "undici";

secrets 5

  • secrets githits-com-githits-cli-dc148c5/eval/drivers/claude-cli.ts :63 if (process.env.ANTHROPIC_API_KEY) {
  • secrets githits-com-githits-cli-dc148c5/eval/drivers/codex-cli.ts :65 if (process.env.OPENAI_API_KEY) {
  • secrets githits-com-githits-cli-dc148c5/packages/core-internal/src/services/config.ts :102 return process.env.GITHITS_API_TOKEN;
  • secrets (weak) githits-com-githits-cli-dc148c5/src/commands/mcp.test.ts :498 const previousToken = process.env.GITHITS_API_TOKEN;
  • secrets (weak) githits-com-githits-cli-dc148c5/src/container.test.ts :42 const original = process.env.GITHITS_API_TOKEN;

tool registrations 5

  • quick_start githits-com-githits-cli-dc148c5/eval/mock-mcp/server.ts :103
  • pkg_vulns githits-com-githits-cli-dc148c5/eval/mock-mcp/server.ts :116
  • pkg_info githits-com-githits-cli-dc148c5/eval/mock-mcp/server.ts :140
  • pkg_changelog githits-com-githits-cli-dc148c5/eval/mock-mcp/server.ts :161
  • read githits-com-githits-cli-dc148c5/eval/mock-mcp/server.ts :189

install hooks 3

  • prepare githits-com-githits-cli-dc148c5/package.json :68 husky
  • prepack githits-com-githits-cli-dc148c5/package.json :69 bun run plugins:check
  • prepublishOnly githits-com-githits-cli-dc148c5/package.json :70 bun run build

declared dependencies 23

  • @modelcontextprotocol/sdk@^1.29.0
  • @inquirer/checkbox@5.2.1
  • @inquirer/confirm@6.1.1
  • @inquirer/core@11.2.1
  • @inquirer/select@5.2.1
  • @napi-rs/keyring@^2.0.0
  • commander@15.0.0
  • fast-string-width@^3.0.2
  • jsonc-parser@^3.3.1
  • open@^11.0.0
  • semver@7.8.5
  • smol-toml@^1.6.1
show 11 more
  • undici@7.29.0
  • yaml@^2.9.0
  • zod@^4.4.3
  • @biomejs/biome@2.5.6
  • @types/bun@latest
  • @types/semver@^7.7.1
  • braintrust@3.29.0
  • bunup@^0.16.32
  • husky@^9.1.7
  • lint-staged@17.3.0
  • typescript@^7.0.2