Model Context Protocol server with 260+ tools for AI agents
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 18ee5e2 · analyzer v28 · 21h ago
danger signals4
- suspicious endpoint test.ngrok.io hanzoai-mcp-18ee5e2/test/search/integration.test.ts :210
jest.spyOn(tunnel as any, 'fetchTunnelUrl').mockResolvedValue('https://test.ngrok.io'); - suspicious endpoint test.ngrok.io hanzoai-mcp-18ee5e2/test/search/secure-tunnel.test.ts :360
jest.spyOn(tunnel as any, 'fetchTunnelUrl').mockResolvedValue('https://test.ngrok.io'); - suspicious endpoint abc123.ngrok.io hanzoai-mcp-18ee5e2/test/search/url-helper.test.ts :68
mockGetTunnelUrl.mockReturnValue('https://abc123.ngrok.io'); - suspicious endpoint tunnel.ngrok.io hanzoai-mcp-18ee5e2/test/search/url-helper.test.ts :303
mockGetTunnelUrl.mockReturnValue('https://tunnel.ngrok.io');
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 181
filesystem 30
- fs hanzoai-mcp-18ee5e2/src/autogui/adapters/base.ts :196
const buffer = await fs.readFile(path); - fs hanzoai-mcp-18ee5e2/src/autogui/adapters/pyautogui.ts :7
import { promises as fs } from 'fs'; - fs hanzoai-mcp-18ee5e2/src/autogui/adapters/rust.ts :7
import { promises as fs } from 'fs'; - fs hanzoai-mcp-18ee5e2/src/cli.ts :17
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/orchestration/agent-tools.ts :9
import { promises as fs } from 'fs'; - fs hanzoai-mcp-18ee5e2/src/prompts/system.ts :5
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/search/file-server.ts :8
import { promises as fs } from 'fs'; - fs hanzoai-mcp-18ee5e2/src/search/search-engine.ts :6
import { promises as fs } from 'fs'; - fs hanzoai-mcp-18ee5e2/src/search/unified-search.ts :9
import { promises as fs } from 'fs'; - fs hanzoai-mcp-18ee5e2/src/search/url-helper.ts :6
import { promises as fs } from 'fs'; - fs hanzoai-mcp-18ee5e2/src/tools/ast-search.ts :7
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/edit.ts :5
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/file-ops.ts :5
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/hanzo-desktop.ts :15
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/memory.ts :8
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/plan.ts :7
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/refactor.ts :9
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/search.ts :8
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/tasks.ts :7
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/ui-local-client.ts :9
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/ui-registry.ts :7
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/unified-ui.ts :15
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/unified/code.ts :8
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/unified/fetch.ts :8
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/unified/fs.ts :8
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/unified/workspace.ts :8
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/tools/vector-search.ts :7
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/ui/ui-tools.ts :9
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/ui/unified-ui-tool.ts :18
import * as fs from 'fs/promises'; - fs hanzoai-mcp-18ee5e2/src/vector/lancedb-store.ts :6
import { promises as fs } from 'fs';
shell / exec 25
- shell hanzoai-mcp-18ee5e2/src/autogui/adapters/pyautogui.ts :6
import { spawn, ChildProcess } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/autogui/adapters/rust.ts :6
import { spawn, ChildProcess } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/orchestration/agent-tools.ts :8
import { spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/prompts/system.ts :7
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/search/secure-tunnel.ts :6
import { spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/search/strategies/ast-search.ts :5
import { spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/search/strategies/text-search.ts :5
import { spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/search/unified-search.ts :8
import { spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/community/cryptuon/compress-solana.ts :15
import { spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/community/cryptuon/tesseract-deploy.ts :14
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/community/cryptuon/tesseract-health-check.ts :12
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/community/cryptuon/tesseract-monitor.ts :12
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/git.ts :8
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/hanzo-desktop.ts :12
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/refactor.ts :7
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/search.ts :5
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/shell.ts :5
import { exec, spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/ui-registry.ts :9
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/unified-ui.ts :13
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/unified/code.ts :10
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/unified/exec.ts :8
import { exec, spawn } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/unified/fetch.ts :10
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/unified/fs.ts :11
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/tools/unified/workspace.ts :10
import { exec } from 'child_process'; - shell hanzoai-mcp-18ee5e2/src/vector/lancedb-store.ts :9
import { spawn } from 'child_process';
network 15
- net hanzoai-mcp-18ee5e2/src/search/file-server.ts :6
import { createServer, IncomingMessage, ServerResponse } from 'http'; - net hanzoai-mcp-18ee5e2/src/search/index.ts :118
const document = await engine.fetch(id); - net hanzoai-mcp-18ee5e2/src/search/search-engine.ts :121
async fetch(id: string): Promise<Document> { - net hanzoai-mcp-18ee5e2/src/search/secure-tunnel.ts :8
import https from 'https'; - net hanzoai-mcp-18ee5e2/src/search/types.ts :102
fetch(id: string): Promise<Document>; - net hanzoai-mcp-18ee5e2/src/tools/code-intel.ts :32
const r = await fetch(url, { ...opts, headers: { 'Content-Type': 'application/json', 'Accept': 'text/markdown', 'Authorization': `Bearer ${t}`, ...(opts.headers || {}) } }); - net hanzoai-mcp-18ee5e2/src/tools/gimp.ts :13
import { connect } from 'net'; - net hanzoai-mcp-18ee5e2/src/tools/hanzo-cloud.ts :29
const r = await fetch(`${base}${path}`, { ...opts, headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${t}`, ...(opts.headers || {}) } }); - net hanzoai-mcp-18ee5e2/src/tools/hanzo-desktop.ts :239
const response = await fetch('http://localhost:9090'); - net hanzoai-mcp-18ee5e2/src/tools/playwright-control.ts :539
const response = await fetch(`http://localhost:${this.debugPort}`, { - net hanzoai-mcp-18ee5e2/src/tools/think.ts :59
const r = await fetch(`${baseUrl}/chat/completions`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}` }, body: JSON.stringify(body) }); - net hanzoai-mcp-18ee5e2/src/tools/ui-github-api.ts :6
import * as https from 'https'; - net hanzoai-mcp-18ee5e2/src/tools/unified-ui.ts :125
const response = await fetch('https://ui.hanzo.ai/registry/index.json'); - net hanzoai-mcp-18ee5e2/src/tools/unified/fetch.ts :95
const resp = await fetch(args.url, opts); - net hanzoai-mcp-18ee5e2/src/ui/registry-api.ts :43
const response = await fetch(itemUrl);
secrets 5
- secrets hanzoai-mcp-18ee5e2/src/search/secure-tunnel.ts :68
ngrokApiKey: config.ngrokApiKey || process.env.NGROK_API_KEY, - secrets hanzoai-mcp-18ee5e2/src/tools/code-intel.ts :23
function token(): string { return process.env.HANZO_API_KEY || process.env.API_KEY || process.env.API_TOKEN || process.env.HANZO_TOKEN || ''; } - secrets hanzoai-mcp-18ee5e2/src/tools/hanzo-cloud.ts :24
function token(): string { return process.env.HANZO_API_KEY || process.env.API_KEY || process.env.API_TOKEN || process.env.HANZO_TOKEN || ''; } - secrets hanzoai-mcp-18ee5e2/src/tools/think.ts :49
const apiKey = process.env.HANZO_API_KEY || process.env.API_KEY || process.env.OPENAI_API_KEY; - secrets hanzoai-mcp-18ee5e2/src/tools/ui-github-api.ts :163
this.token = process.env.GITHUB_TOKEN || process.env.GITHUB_PERSONAL_ACCESS_TOKEN || null;
install hooks 1
- prepublishOnly hanzoai-mcp-18ee5e2/package.json :28
pnpm build
declared dependencies 89
- @modelcontextprotocol/sdk@^1.27.1
- @types/mime-types@^3.0.1
- commander@^14.0.3
- glob@^13.0.6
- mime-types@^3.0.2
- minimatch@^10.2.4
- ws@^8.20.0
- zod@^4.3.6
- zod-to-json-schema@^3.25.1
- @jest/globals@^30.3.0
- @types/glob@^9.0.0
- @types/jest@^30.0.0
- @types/minimatch@^6.0.0
- @types/node@^25.5.0
- @types/ws@^8.18.1
- esbuild@^0.28.1
- jest@^30.3.0
- ts-jest@^29.4.6
- typescript@^7.0.2
- @lancedb/lancedb@^0.27.1
- @xenova/transformers@^2.17.2
- jsautogui@^2.1.3
- playwright@^1.58.2
- playwright-core@^1.58.2
- github.com/hanzoai/cloud@v0.1.0
- github.com/luxfi/log@v1.4.3
- github.com/zap-proto/zip@v1.10.0
- github.com/andybalholm/brotli@v1.2.1
- github.com/dlclark/regexp2/v2@v2.2.1
- github.com/dop251/goja@v0.0.0-20260607120635-348e6bea910d
- github.com/evanw/esbuild@v0.28.1
- github.com/go-sourcemap/sourcemap@v2.1.3+incompatible
- github.com/gofiber/schema@v1.7.1
- github.com/gofiber/utils/v2@v2.0.4
- github.com/google/pprof@v0.0.0-20230207041349-798e818bf904
- github.com/google/uuid@v1.6.0
- github.com/klauspost/compress@v1.18.5
- github.com/mattn/go-colorable@v0.1.14
- github.com/mattn/go-isatty@v0.0.21
- github.com/philhofer/fwd@v1.2.0
- github.com/tinylib/msgp@v1.6.4
- github.com/valyala/bytebufferpool@v1.0.0
- github.com/valyala/fasthttp@v1.70.0
- github.com/zap-proto/fiber/v3@v3.2.1
- github.com/zap-proto/go@v1.3.0
- github.com/zap-proto/http@v0.3.0
- golang.org/x/crypto@v0.50.0
- golang.org/x/net@v0.53.0
- golang.org/x/sys@v0.43.0
- golang.org/x/text@v0.36.0
- gopkg.in/natefinch/lumberjack.v2@v2.2.1
- tokio@1
- async-trait@0.1
- serde@1.0
- serde_json@1.0
- serde_yaml@0.9
- toml@0.8
- sha2@0.10
- blake3@1.5
- jsonrpc-core@18.0
- jsonrpc-derive@18.0
- jsonrpc-http-server@18.0
- log@0.4
- env_logger@0.10
- anyhow@1.0
- thiserror@1.0
- dirs@5.0
- clap@4.4
- reqwest@0.11
- walkdir@2.4
- glob@0.3
- regex@1.10
- rayon@1.8
- once_cell@1.19
- base64@0.21
- shellexpand@3.1
- chrono@0.4
- tempfile@3.10
- which@6.0
- shell-escape@0.1
- tree-sitter@0.20
- tree-sitter-rust@0.20
- tree-sitter-javascript@0.20
- tree-sitter-typescript@0.20
- tree-sitter-python@0.20
- tree-sitter-go@0.20
- tree-sitter-java@0.20
- tree-sitter-cpp@0.20
- tree-sitter-c@0.20