Long-context project memory for Claude Code / Cursor / Codex — a local MCP server with hybrid retrieval (dense + BM25 + cross-encoder rerank). Falsification-first benchmarks, honest nulls.
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution ×3 in harshithkantamneni/bert
- HIGH code analysis flagged dynamic code execution in harshithkantamneni/bert
- HIGH code analysis flagged dynamic code execution ×5 in harshithkantamneni/bert
- HIGH code analysis flagged dynamic code execution ×5 in harshithkantamneni/bert
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit ac605c7 · analyzer v33 · 1w ago
skills & prompt files 11
- prompt-file harshithkantamneni-bert-ac605c7/prompts/charter_template.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/clearness_phase1.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/clearness_phase2.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/director.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/director_decision.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/evaluator.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/implementer.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/researcher.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/strategist.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/threshing.md
- skill harshithkantamneni-bert-ac605c7/skills/lab-tools/SKILL.md
danger signals8
- dynamic code execution __import__ sink harshithkantamneni-bert-ac605c7/benchmarks/v2_claude_track.py :125
workers = int(__import__("os").environ.get("BERT_CLAUDE_WORKERS", "4")) - dynamic code execution __import__ sink harshithkantamneni-bert-ac605c7/core/agent.py :218
pid=__import__("os").getpid(), role=role, cycle=cycle, - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/core/mcp_server.py :355
mod = __import__(f"tools.mcp.{modname}", fromlist=["make_server"]) - dynamic code execution eval()/exec() harshithkantamneni-bert-ac605c7/core/tool_synthesizer.py :327
exec(compile(source, str(path), "exec"), ns) # noqa: S102 # nosec B102 — runs ONLY on PI-blessed, sandbox-validated source, never raw model output - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tests/_smoke_mcp_custom_servers.py :27
mod = __import__(f"tools.mcp.{modname}", fromlist=["make_server"]) - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tests/_smoke_role_capability.py :24
return __import__(f"evals.role_capability.{role}", - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tools/bert_doctor.py :84
__import__(mod) - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tools/run_capability_harness.py :130
mod = __import__(f"evals.role_capability.{role}",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 507
filesystem 346
- fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b1_latency_throughput.py :37
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b2_beir_multi.py :41
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b2_beir_scifact.py :54
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b2_retrieval_quality.py :46
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b3_memory_longmemeval.py :45
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b5_adversarial_eval.py :42
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b6_compile_report.py :26
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b7_ab_infra.py :25
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b7_runner_loop.py :12
import shutil - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b9_agentic_grep.py :19
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b9_aider_retrieve.py :28
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b9_graph_retrieve.py :23
from pathlib import Path
show 28 more
- fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/b9_rag_runner.py :14
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/m1_arms.py :26
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/m1_corpus.py :25
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/m1_report.py :12
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b10_niah.py :13
import shutil - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b7_harness_lift.py :23
import shutil - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b9_aider_recall.py :14
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b9_graph_recall.py :12
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b9_grep_pilot.py :20
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b9_pilot.py :14
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b9_wall.py :16
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_arms.py :29
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_bert_tool_arm.py :20
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_big_corpus.py :18
import shutil - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_claude_track.py :28
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_clean_rows.py :9
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_corpora.py :36
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_fix_a5.py :9
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_frontier_reader.py :25
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_gold_ast.py :58
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_mcp_arm.py :26
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_precompute_aider.py :18
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_precompute_semantic.py :10
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_preflight.py :14
import shutil - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_report.py :12
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_run.py :28
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_tokenomics.py :21
from pathlib import Path - fs (weak) harshithkantamneni-bert-ac605c7/benchmarks/v3_report.py :14
from pathlib import Path
306 more not shown — this panel samples each group; the count above is the real total.
shell / exec 52
- shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/b7_ab_infra.py :23
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/b7_runner_loop.py :13
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/b9_rag_runner.py :198
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/run_b7_harness_lift.py :24
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_arms.py :27
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_big_corpus.py :19
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_corpora.py :34
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_frontier_reader.py :22
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_mcp_arm.py :24
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_tokenomics.py :18
import subprocess - shell harshithkantamneni-bert-ac605c7/core/host_detector.py :25
import subprocess - shell harshithkantamneni-bert-ac605c7/core/mcp_client.py :36
import subprocess
show 28 more
- shell harshithkantamneni-bert-ac605c7/core/mission_profile.py :37
import subprocess - shell harshithkantamneni-bert-ac605c7/core/sandbox.py :25
import subprocess - shell harshithkantamneni-bert-ac605c7/core/subagent.py :498
import subprocess - shell harshithkantamneni-bert-ac605c7/core/tool_synthesizer.py :128
# attribute sinks: os.system(...), os.popen(...), shutil.rmtree, ... - shell harshithkantamneni-bert-ac605c7/core/tools.py :14
import subprocess - shell harshithkantamneni-bert-ac605c7/core/verify_engine.py :33
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_acceptance_demo_flight.py :31
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_e2e_mcp_full_lifecycle.py :34
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_security_boundaries.py :30
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_bb_phase.py :17
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_cc_director.py :16
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_cosign_compat.py :20
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_dd_reproduce_disclosure.py :24
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_h3_polish.py :4
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_i2_proof_packet.py :9
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_i3_failures_adversarial.py :7
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_i6_templates.py :7
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_l3_chain_states.py :19
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_otel_wiring.py :12
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_pace_layer_integration.py :8
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_phase_abcde_edge.py :31
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_phase_abcde_pessimistic.py :31
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_r2_live_cycle_flag.py :14
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_t1_weekly_history.py :14
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_t2_bert_doctor.py :18
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_tool_synthesizer.py :65
res = ts.static_safety_scan("import subprocess\ndef f(**k):\n return 1\n") - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_u_daily_history.py :17
import subprocess - shell (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_v_phase.py :15
import subprocess
12 more not shown — this panel samples each group; the count above is the real total.
network 18
- net harshithkantamneni-bert-ac605c7/core/mcp_client.py :244
import httpx - net harshithkantamneni-bert-ac605c7/core/provider.py :15
import httpx - net harshithkantamneni-bert-ac605c7/core/semantic_cache.py :212
import httpx - net harshithkantamneni-bert-ac605c7/core/tools.py :15
import urllib.parse - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_core_provider.py :4
run directly; call() + probe_models() run against a faked httpx.Client - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_core_tools.py :11
- _webfetch / _websearch with a faked httpx.Client (html/json/404/empty) - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_h4_wiring.py :51
with mock.patch("httpx.Client") as mc: - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_lifecycle_integration.py :118
provider.call's body to execute, mock httpx.Client instead via - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_mcp_http.py :5
client structure with monkeypatched httpx. - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_t2_bert_doctor.py :17
import socket - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_tools_bert_doctor.py :74
import urllib.request - net (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_tools_recorders.py :176
monkeypatch.setattr(rd.urllib.request, "urlopen", lambda *a, **k: _Resp())
show 6 more
- net harshithkantamneni-bert-ac605c7/tools/bert_doctor.py :24
import socket - net harshithkantamneni-bert-ac605c7/tools/bert_init.py :93
import socket - net harshithkantamneni-bert-ac605c7/tools/eval/api_probe.py :12
import urllib.error - net harshithkantamneni-bert-ac605c7/tools/measure_ollama_prefix_cache.py :86
import httpx - net (weak) harshithkantamneni-bert-ac605c7/tools/record_demo.py :32
import urllib.request - net harshithkantamneni-bert-ac605c7/tools/record_explainer.py :38
import urllib.request
secrets 8
- secrets harshithkantamneni-bert-ac605c7/core/config.py :75
if os.environ.get("GOOGLE_API_KEY") and not creds.get("GOOGLE_AI_API_KEY"): - secrets harshithkantamneni-bert-ac605c7/core/host_detector.py :110
if os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN"): - secrets (weak) harshithkantamneni-bert-ac605c7/tests/_security_boundaries.py :363
"import os; print('BERT_TEST_SECRET=' + os.environ.get('BERT_TEST_SECRET', 'MISSING'))"] - secrets (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_bb_phase.py :149
os.environ["NVIDIA_API_KEY"] = "nvapi-test" - secrets (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_t2_bert_doctor.py :172
os.environ["GROQ_API_KEY"] = old - secrets (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_w_phase.py :108
old = os.environ.get("GROQ_API_KEY") - secrets harshithkantamneni-bert-ac605c7/tools/bert_doctor.py :96
if os.environ.get("GROQ_API_KEY"): - secrets (weak) harshithkantamneni-bert-ac605c7/tools/record_demo.py :452
if not os.environ.get("GROQ_API_KEY"):
database 34
- db (weak) harshithkantamneni-bert-ac605c7/benchmarks/b1_latency_throughput.py :307
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/benchmarks/b9_aider_retrieve.py :27
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/benchmarks/b9_graph_retrieve.py :22
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/benchmarks/v2_preflight.py :15
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/bm25.py :22
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/delegation.py :25
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/graph_store.py :46
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/idle_compute.py :57
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/mcp_replay.py :40
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/memory.py :22
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/memory_adapters/code_repo.py :27
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/memory_tiers.py :30
import sqlite3
show 22 more
- db harshithkantamneni-bert-ac605c7/core/migrations/__init__.py :50
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/quota.py :26
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/retrieval.py :250
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/semantic_cache.py :62
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/token_graph.py :31
import sqlite3 - db harshithkantamneni-bert-ac605c7/core/tools.py :677
import sqlite3 as _sql - db harshithkantamneni-bert-ac605c7/core/watchdog.py :30
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_security_boundaries.py :28
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_core_bm25_ext.py :14
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_core_memory.py :184
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_core_retrieval.py :18
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_core_retrieval_ext.py :12
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_h4_wiring.py :71
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_k6_provider_cooled.py :12
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_lifecycle_integration.py :24
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_mcp_replay.py :46
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_phase_abcde_chaos.py :26
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_phase_abcde_edge.py :27
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_phase_abcde_pessimistic.py :30
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_quota.py :126
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_robustness.py :30
import sqlite3 - db (weak) harshithkantamneni-bert-ac605c7/tests/_smoke_watchdog.py :49
import sqlite3
declared dependencies 13
- httpx@>=0.28.0
- jsonschema@>=4.23.0
- pyyaml@>=6.0.2
- sqlite-vec@>=0.1.7
- sentence-transformers@>=3.3.1
- ryugraph@>=25.9.2
- t@represent (matches vLLM auto-mode pattern).
- pytest@>=8.3.0
- pytest-asyncio@>=0.24.0
- ruff@>=0.8.0
- mypy@>=1.13.0
- ir-datasets@>=0.5.0
show 1 more
- rank-bm25@>=0.2.2