MCP Observatory
4m ago Tracked 60,039 Last 4m ago 24h 2,475
github TypeScript analyzed fa63ea7

hfrictor/AgenticRelay

github

Coordination layer on MCP for teams running AI coding agents on the same repo: shared awareness and reviewable memory across developers, machines, and agent vendors.

maintainer
hfrictor
licence
Apache-2.0
first seen
2026-08-05
last seen
2026-08-08
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in hfrictor/AgenticRelay
  2. HIGH code analysis flagged committed secret ×8 in hfrictor/AgenticRelay
capabilities 15 tools
transport stdio counts 15 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • relay_approve_merge
  • relay_check_conflicts
  • relay_claim
  • relay_claim_work
  • relay_list_references
  • relay_merge_status
  • relay_pending_approvals
  • relay_read_reference
  • relay_record_learning
  • relay_release
  • relay_report_change
  • relay_request_merge
  • relay_search_memory
  • relay_team_status
  • relay_who_touched
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit fa63ea7 · analyzer v33 · 2w ago

danger signals1

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 159

filesystem 47

  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/__fixtures__/mockAdapter.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/builtins.conformance.test.ts :2 import { mkdtempSync } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/claude-code/index.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/codex-cli/index.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/common.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/conformance.test.ts :2 import { mkdtempSync } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/gemini-cli/index.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/registry.test.ts :2 import { mkdtempSync, writeFileSync } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/adapters/src/registry.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/doctor.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/extract.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/mirror.ts :1 import { promises as fs } from "node:fs";
show 28 more
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/transcript.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/audit.test.ts :2 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/audit.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/mergeOps.ts :2 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/pipeline.integration.test.ts :3 import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/standards.test.ts :2 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/standards.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/detect.ts :2 import { readlinkSync } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/digestCache.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/ignore.test.ts :2 import { mkdtempSync, writeFileSync, mkdirSync } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/ignore.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/queue.test.ts :2 import { mkdtempSync } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/queue.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/firebaseConfig.ts :1 import { readFileSync } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/hooks/gate.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/mcp/register.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/repoConfig.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/state.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/sync/generate.ts :1 import { promises as fs } from "node:fs";
  • fs hfrictor-AgenticRelay-fa63ea7/packages/cli/src/tokenStore.ts :1 import { promises as fs } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/packages/functions/test/rules/helpers.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-context.mjs :8 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, realpathSync, rmSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-entitlements.mjs :8 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, realpathSync, rmSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-prod.mjs :13 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync, realpathSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-rename.mjs :5 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, realpathSync, rmSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-repo.mjs :7 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, realpathSync, rmSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-web.mjs :8 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, realpathSync, rmSync } from "node:fs";
  • fs (weak) hfrictor-AgenticRelay-fa63ea7/scripts/pack-cli.mjs :12 import { mkdtempSync, mkdirSync, copyFileSync, writeFileSync, readFileSync, readdirSync, renameSync, existsSync } from "node:fs";

7 more not shown — this panel samples each group; the count above is the real total.

shell / exec 21

  • shell hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/merge.ts :1 import { execFileSync } from "node:child_process";
  • shell hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/mirror.ts :2 import { execFileSync } from "node:child_process";
  • shell hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/sync.ts :1 import { execFileSync } from "node:child_process";
  • shell hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/mergeOps.ts :1 import { execFileSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/pipeline.integration.test.ts :2 import { execFileSync } from "node:child_process";
  • shell hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/validate.ts :1 import { execFileSync, execSync } from "node:child_process";
  • shell hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/detect.ts :1 import { execFileSync } from "node:child_process";
  • shell hfrictor-AgenticRelay-fa63ea7/packages/cli/src/git.ts :1 import { execFileSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-context.mjs :7 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-entitlements.mjs :7 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-prod.mjs :12 import { execFileSync, spawn, spawnSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-rename.mjs :4 import { execFileSync, spawnSync } from "node:child_process";
show 9 more
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-repo.mjs :6 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-web.mjs :7 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/pack-cli.mjs :11 import { execFileSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase1.mjs :12 import { execFileSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase2.mjs :12 import { execFileSync, spawn } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase3.mjs :14 import { execFileSync, spawn } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase4.mjs :12 import { execFileSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase6.mjs :12 import { execFileSync } from "node:child_process";
  • shell (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase7.mjs :11 import { execFileSync } from "node:child_process";

network 17

  • net hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/semanticMerge.ts :5 * Tier-2 semantic merge via the Anthropic Messages API. Raw fetch (consistent with the
  • net hfrictor-AgenticRelay-fa63ea7/packages/cli/src/daemon/firestoreRest.ts :159 res = await fetch(`${this.#base}/${path}`, {
  • net hfrictor-AgenticRelay-fa63ea7/packages/cli/src/extraction/llm.ts :23 const res = await fetch(url, {
  • net hfrictor-AgenticRelay-fa63ea7/packages/cli/src/storageRest.ts :39 const res = await this.#fetch(`${this.#base}?prefix=${encodeURIComponent(prefix)}`);
  • net (weak) hfrictor-AgenticRelay-fa63ea7/packages/shared/src/conflict.test.ts :81 + await fetch("https://inventory/reserve", { method: "POST" });
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-context.mjs :31 const r = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${API_KEY}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-entitlements.mjs :30 const r = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${API_KEY}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-prod.mjs :101 const res = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${API_KEY}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-rename.mjs :27 const r = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${API_KEY}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-repo.mjs :29 const r = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${API_KEY}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/e2e-web.mjs :31 const r = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${API_KEY}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase1.mjs :88 const res = await fetch(`${base}/${path}`, {
show 5 more
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase2.mjs :81 const res = await fetch(`${base}/${path}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase3.mjs :68 const res = await fetch(`${base}/${path}`, { headers: { Authorization: "Bearer owner" } });
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase4.mjs :77 const r = await fetch(`${base}/${path}`, {
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase6.mjs :68 const r = await fetch(`${base}/${path}`, { method: "PATCH", headers: { Authorization: "Bearer owner", "Content-Type": "application/json" }, body: JSON.stringify({ fields: ef(data) }) });
  • net (weak) hfrictor-AgenticRelay-fa63ea7/scripts/verify-phase7.mjs :68 const r = await fetch(`${base}/orgs/${orgId}/repos/${repoId}/learnings`, { headers: { Authorization: "Bearer owner" } });

secrets 2

  • secrets hfrictor-AgenticRelay-fa63ea7/packages/cli/src/commands/login.ts :31 opts.password ?? process.env.RELAY_PASSWORD ?? (await promptHidden("Password: "));
  • secrets hfrictor-AgenticRelay-fa63ea7/packages/cli/src/conflict/build.ts :45 const apiKey = process.env.ANTHROPIC_API_KEY;

tool registrations 15

  • relay_team_status hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :34
  • relay_who_touched hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :51
  • relay_claim hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :75
  • relay_release hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :102
  • relay_search_memory hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :121
  • relay_record_learning hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :140
  • relay_list_references hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :169
  • relay_read_reference hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :186
  • relay_claim_work hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :209
  • relay_check_conflicts hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :230
  • relay_report_change hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :247
  • relay_request_merge hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :267
show 3 more
  • relay_pending_approvals hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :284
  • relay_approve_merge hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :301
  • relay_merge_status hfrictor-AgenticRelay-fa63ea7/packages/mcp/src/tools.ts :323

declared dependencies 5

  • @modelcontextprotocol/sdk@^1.13.0
  • @types/node@^20.14.0
  • typescript@^5.5.4
  • vite-tsconfig-paths@^5.0.1
  • vitest@^2.1.8