github analyzed e9b3f11

gosswerner1-max/lazyrelay

Schedule social posts, check Proof-of-Publish status, pull analytics, and read mentions.

maintainer: gosswerner1-max
licence: —
first seen: 2026-08-28
last seen: 2026-08-28
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 9 tools

transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 9 tools · 0 res · 0 prompts permission surface via code analysis

tools

delete_scheduled_post
get_analytics_summary
get_mentions
list_connected_accounts
list_scheduled_posts
list_workspaces
publish_post_now
schedule_post
update_post

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e9b3f11 · analyzer v33 · 3h ago

danger signals16

suspicious endpoint api.telegram.org gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/telegram.ts :35 const API_BASE = "https://api.telegram.org";
suspicious endpoint t.me gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/telegram.ts :260 const platformPostUrl = chat.username ? `https://t.me/${chat.username}/${platformPostId}` : null;
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose gosswerner1-max-lazyrelay-e9b3f11/backend/src/posthogClient.ts :17 client = apiKey ? new PostHog(apiKey, { host: "https://us.i.posthog.com" }) : null;
suspicious endpoint 169.254.169.254 (cloud metadata) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-low-severity-fixes.ts :38 body: JSON.stringify({ slug: "lowsev-test", title: "Test", bio: "Test bio", avatarUrl: "https://169.254.169.254/x" }),
suspicious endpoint 169.254.169.254 (cloud metadata) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-stream-upload-safety.ts :31 const blockedResult = await fetchMediaForStreaming("https://169.254.169.254/latest/meta-data/");
suspicious endpoint 169.254.169.254 (cloud metadata) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-url-safety.ts :14 { url: "https://169.254.169.254/latest/meta-data/", expectSafe: false, label: "cloud metadata IP rejected" },
suspicious endpoint 8.8.8.8 gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-url-safety.ts :26 { url: "https://8.8.8.8/x", expectSafe: true, label: "real public IP (Google DNS) accepted" },
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose gosswerner1-max-lazyrelay-e9b3f11/frontend/src/lib/posthog.ts :13 const POSTHOG_HOST = "https://us.i.posthog.com";
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/generate-test-account-password.ts :24 console.log("PASSWORD:", password);
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-mastodon-sandbox-e2e.ts :82 console.log("Retrieved real access token from Vault (length:", (accessToken as string).length, ")");
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-paddle-upgrade-setup.ts :39 console.log(JSON.stringify({ email, password, accountId, socialAccountId: socialAccount.id }, null, 2));
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-pinterest-sandbox-finish.ts :35 console.log("Retrieved real access token from Vault (length:", (accessToken as string).length, ")");
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-pinterest-video-pin.ts :34 console.log("Retrieved real access token from Vault (length:", (accessToken as string).length, ")");
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tiktok-sandbox-finish.ts :34 console.log("Retrieved real access token from Vault (length:", (accessToken as string).length, ")");
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-ui-fixture.ts :15 console.log(JSON.stringify({ email, password, id: user.user.id }));
credential in logs credential in log gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-youtube-sandbox-finish.ts :35 console.log("Retrieved real access token from Vault (length:", (accessToken as string).length, ")");

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 268

filesystem 27

fs gosswerner1-max-lazyrelay-e9b3f11/.claude/hooks/format-and-typecheck.js :11 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/backend/src/fix-tiktok-youtube-video-swap.ts :2 import fs from "node:fs";
fs gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/routes.ts :6 import fs from "node:fs";
fs gosswerner1-max-lazyrelay-e9b3f11/backend/src/schedule-launch-ad-batch.ts :2 import fs from "node:fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-facebook-sandbox-e2e.ts :4 import { existsSync, unlinkSync, readFileSync } from "node:fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-instagram-sandbox-e2e.ts :4 import { existsSync, unlinkSync, readFileSync } from "node:fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-linkedin-sandbox-e2e.ts :4 import { existsSync, unlinkSync, readFileSync } from "node:fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-mastodon-sandbox-e2e.ts :2 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-pinterest-sandbox-start.ts :2 import { writeFileSync } from "fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-threads-sandbox-e2e.ts :4 import { existsSync, unlinkSync, readFileSync } from "node:fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tiktok-sandbox-start.ts :2 import { writeFileSync } from "fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tumblr-sandbox-e2e.ts :4 import { existsSync, unlinkSync, readFileSync } from "node:fs";

show 15 more

fs (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-youtube-sandbox-start.ts :2 import { writeFileSync } from "fs";
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/frontend/scripts/prerender.mjs :53 import { existsSync } from "node:fs";
fs gosswerner1-max-lazyrelay-e9b3f11/ops/billing/billing_ops.js :13 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/config/credentials.js :13 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/infra/backup_storage.js :18 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/oversight/accounts_auditor.js :8 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/oversight/advertising_auditor.js :7 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/oversight/billing_auditor.js :6 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/oversight/marketing_auditor.js :10 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/oversight/system_overseer.js :13 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/reports/infrastructure_report.js :15 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/reports/weekly_report.js :20 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/ops/shared/stateStore.js :10 const fs = require("fs");
fs (weak) gosswerner1-max-lazyrelay-e9b3f11/ops/tests/runSelfTest.js :21 const fs = require("fs");
fs gosswerner1-max-lazyrelay-e9b3f11/support/email-agent/imap-tool.js :20 const fs = require("fs");

shell / exec 2

shell gosswerner1-max-lazyrelay-e9b3f11/.claude/hooks/format-and-typecheck.js :13 const { execFileSync } = require("child_process");
shell (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-batch-size-config.ts :2 import { spawnSync } from "node:child_process";

network 54

net gosswerner1-max-lazyrelay-e9b3f11/backend/src/fix-tiktok-youtube-video-swap.ts :40 const res = await fetch(`${BACKEND_URL}/media/upload`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleCalendar/connect.ts :39 const createRes = await fetch(`${CALENDAR_API_BASE}/calendars`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleCalendar/inboundSync.ts :82 const res = await fetch(`${CALENDAR_API_BASE}/calendars/${calendarId}/events?${params.toString()}`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleCalendar/oauthClient.ts :5 // would risk both features' review state together. Same raw-fetch()
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleCalendar/outboundSync.ts :80 const res = await fetch(url, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleCalendar/pushNotifications.ts :64 const res = await fetch(`${CALENDAR_API_BASE}/calendars/${connection.google_calendar_id}/events/watch`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleSheets/connect.ts :35 const createRes = await fetch(SHEETS_API_BASE, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleSheets/oauthClient.ts :84 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleSheets/outboundSync.ts :76 await fetch(`${SHEETS_API_BASE}/${connection.spreadsheet_id}/values/${rangePrefix}!A2:G${MAX_TRACKED_ROWS + 1}:clear`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpAuth.ts :163 const res = await fetch(url);
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :50 const res = await fetch(`${API_BASE}${path}`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/metaWebhook.ts :20 const res = await fetch(url, { method: "POST" });

show 28 more

net gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/routes.ts :1288 // cross-origin fetch() and — for Bluesky/Telegram/Discord, which
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/load-test.ts :79 const res = await fetch(url, { headers: { Authorization: `Bearer ${jwt}` } });
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/notify.ts :14 await fetch(webhookUrl, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/bluesky.ts :212 const res = await fetch(CREATE_SESSION_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/discord.ts :106 const res = await fetch(webhookUrl);
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/facebook.ts :115 const res = await fetch(url.toString());
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/instagram.ts :131 const res = await fetch(url.toString());
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/linkedin.ts :92 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/mastodon.ts :99 const res = await fetch(`${DEFAULT_INSTANCE}/api/v1/apps`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/pinterest.ts :120 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/streamUpload.ts :25 import { isIP } from "node:net";
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/telegram.ts :115 const res = await fetch(`${API_BASE}/bot${botToken}/${method}`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/threads.ts :92 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/tiktok.ts :88 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/tumblr.ts :74 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/x.ts :105 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/youtube.ts :125 const res = await fetch(TOKEN_URL, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/schedule-launch-ad-batch.ts :89 const res = await fetch(`${BACKEND_URL}/media/upload`, {
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/security-test.ts :132 const noAuth = await fetch(`${API_URL}/social-accounts`);
net gosswerner1-max-lazyrelay-e9b3f11/backend/src/stress-test.ts :162 fetch(`${API_URL}/social-accounts`, { headers: { Authorization: `Bearer ${jwt}` } }),
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-cors-preflight.ts :54 const res = await fetch(`${base}/api/account`, {
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-free-tier-limit.ts :60 const res = await fetch(`${API_URL}/scheduled-posts`, {
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-http.ts :31 const health = await fetch(`http://localhost:${PORT}/health`).then((r) => r.json());
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-low-severity-fixes.ts :35 const badAvatarRes = await fetch(`${API_URL}/bio-page`, {
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-mcp-http.ts :57 const res = await fetch(`${base}/.well-known/oauth-protected-resource/mcp`);
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-mcp-oauth-seam.ts :36 const res = await fetch(`${supabaseUrl}/.well-known/oauth-authorization-server/auth/v1`);
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-media-upload.ts :47 const uploadRes = await fetch(`${API_URL}/media/upload`, {
net (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-mfa-enforcement.ts :68 const baselineRes = await fetch(`${API_URL}/social-accounts`, { headers: { Authorization: `Bearer ${preEnrollToken}` } });

14 more not shown — this panel samples each group; the count above is the real total.

secrets 51

secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/billing/stub.ts :24 const STUB_WEBHOOK_SECRET = process.env.MOR_WEBHOOK_SECRET || "stub-mode-not-a-real-secret";
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/commentTriage.ts :41 const apiKey = process.env.ANTHROPIC_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/email.ts :15 const apiKey = process.env.RESEND_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleCalendar/oauthClient.ts :45 const clientSecret = process.env.GOOGLE_CALENDAR_CLIENT_SECRET;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/googleSheets/oauthClient.ts :31 const clientSecret = process.env.GOOGLE_CALENDAR_CLIENT_SECRET;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/metaWebhook.ts :52 const expectedToken = process.env.META_WEBHOOK_VERIFY_TOKEN;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/routes.ts :303 const apiKey = process.env.ANTHROPIC_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/index.ts :36 const hasRealMorCredentials = Boolean(process.env.MOR_API_KEY && process.env.MOR_WEBHOOK_SECRET);
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/load-test.ts :49 const authClient = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!, {
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/platforms/registry.ts :26 if (process.env.TIKTOK_CLIENT_KEY && process.env.TIKTOK_CLIENT_SECRET && process.env.TIKTOK_REDIRECT_URI) {
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/posthogClient.ts :16 const apiKey = process.env.POSTHOG_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/security-test.ts :20 const authClient = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!, {

show 28 more

secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/setup-brand-addon-price.ts :17 const apiKey = process.env.MOR_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/setup-live-catalog.ts :12 const apiKey = process.env.LIVE_MOR_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/setup-new-tier-prices.ts :14 const apiKey = process.env.MOR_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/setup-price-increase-2026-07-31.ts :17 const apiKey = process.env.MOR_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/setup-storage-addon-prices.ts :12 const apiKey = process.env.MOR_API_KEY;
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/stress-test.ts :35 const authClient = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!, {
secrets gosswerner1-max-lazyrelay-e9b3f11/backend/src/supabase.ts :4 const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-facebook-sandbox-e2e.ts :19 const clientSecret = process.env.META_APP_SECRET;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-first-comment.ts :31 const clientSecret = process.env.META_APP_SECRET;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-free-tier-limit.ts :15 const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY!;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-http.ts :18 const authClient = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!, {
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-instagram-sandbox-e2e.ts :22 const clientSecret = process.env.META_APP_SECRET;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-linkedin-sandbox-e2e.ts :21 const clientSecret = process.env.LINKEDIN_CLIENT_SECRET;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-low-severity-fixes.ts :16 const authClient = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!, {
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-media-upload.ts :15 const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY!;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-mfa-enforcement.ts :22 const authClient = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!, {
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-pinterest-sandbox-finish.ts :17 const appSecret = process.env.PINTEREST_APP_SECRET!;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-pinterest-sandbox-start.ts :12 const appSecret = process.env.PINTEREST_APP_SECRET;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-pinterest-video-pin.ts :16 const appSecret = process.env.PINTEREST_APP_SECRET!;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-posthog-privacy-mode.ts :21 const anthropicKey = process.env.ANTHROPIC_API_KEY;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-threads-sandbox-e2e.ts :21 const clientSecret = process.env.THREADS_APP_SECRET;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tiktok-adapter.ts :13 const clientKey = process.env.TIKTOK_CLIENT_KEY;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tiktok-eligibility.ts :23 const clientKeyEarly = process.env.TIKTOK_CLIENT_KEY!;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tiktok-sandbox-finish.ts :15 const clientKey = process.env.TIKTOK_CLIENT_KEY!;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tiktok-sandbox-start.ts :10 const clientKey = process.env.TIKTOK_CLIENT_KEY;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-tumblr-sandbox-e2e.ts :19 const clientSecret = process.env.TUMBLR_CLIENT_SECRET;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-youtube-poll-status.ts :12 const clientSecret = process.env.YOUTUBE_CLIENT_SECRET!;
secrets (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-youtube-sandbox-finish.ts :17 const clientSecret = process.env.YOUTUBE_CLIENT_SECRET!;

11 more not shown — this panel samples each group; the count above is the real total.

tool registrations 18

list_connected_accounts gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :88
list_workspaces gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :98
publish_post_now gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :108
schedule_post gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :131
update_post gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :157
list_scheduled_posts gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :180
delete_scheduled_post gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :190
get_analytics_summary gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :201
get_mentions gosswerner1-max-lazyrelay-e9b3f11/backend/src/http/mcpServer.ts :211
list_connected_accounts gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :53
list_workspaces gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :60
schedule_post gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :67

show 6 more

publish_post_now gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :91
update_post gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :112
list_scheduled_posts gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :133
delete_scheduled_post gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :140
get_analytics_summary gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :150
get_mentions gosswerner1-max-lazyrelay-e9b3f11/mcp-server/src/index.ts :157

declared dependencies 31

@modelcontextprotocol/sdk@^1.30.0
@anthropic-ai/sdk@^0.115.0
@paddle/paddle-node-sdk@^3.10.0
@posthog/ai@^8.10.0
@supabase/supabase-js@^2.116.0
cookie-parser@^1.4.7
cors@^2.8.6
dotenv@^16.4.0
express@^5.2.1
express-rate-limit@^7.5.1
file-type@^22.1.0
helmet@^8.3.0

show 19 more

image-size@^2.0.2
jose@^6.2.9
luxon@^3.7.2
multer@^2.3.0
posthog-node@^5.51.6
resend@^6.18.1
undici@^7.29.1
@types/cookie-parser@^1.4.10
@types/cors@^2.8.19
@types/express@^5.0.6
@types/luxon@^3.7.2
@types/multer@^2.2.0
@types/node@^26.5.1
@types/supertest@^7.2.1
prettier@^3.9.6
supertest@^7.2.2
tsx@^4.16.0
typescript@^5.5.0
vitest@^5.0.0

perm:untrusted 3

untrusted gosswerner1-max-lazyrelay-e9b3f11/backend/src/security-test.ts :182 const listA = await fetch(`${API_URL}/scheduled-posts`, { headers: { Authorization: `Bearer ${accountA.jwt}` } }).then((r) => r.json());
untrusted gosswerner1-max-lazyrelay-e9b3f11/backend/src/stress-test.ts :178 fetch(`${API_URL}/platforms`, { headers: { Authorization: `Bearer ${jwt}` } }).then((r) => r.json()),
untrusted (weak) gosswerner1-max-lazyrelay-e9b3f11/backend/src/test-http.ts :31 const health = await fetch(`http://localhost:${PORT}/health`).then((r) => r.json());