hypequery - The TypeScript analytics layer for ClickHouse
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 806e5c4 · analyzer v33 · 16h ago
skills & prompt files 4
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 842
filesystem 94
- fs hypequery-hypequery-806e5c4/packages/cli/src/cli.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/deploy.test.ts :1
import { mkdtemp, rm, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/commands/deploy.ts :1
import { access, constants, open } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/deployment.test.ts :59
import { lstat, mkdir, readFile, realpath, stat, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/commands/deployment.ts :2
import { lstat, mkdir, readFile, realpath, stat, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/dev.test.ts :2
import { watch } from 'node:fs'; - fs hypequery-hypequery-806e5c4/packages/cli/src/commands/dev.ts :1
import { watch } from 'node:fs'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/generate-manifest.test.ts :2
import { mkdir, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/commands/generate-manifest.ts :1
import { mkdir, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/init.test.ts :2
import { mkdir, writeFile, readFile, access } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/commands/init.ts :1
import { mkdir, writeFile, readFile, access } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/live-source.test.ts :2
import { mkdtemp, readFile, rm } from 'node:fs/promises';
show 28 more
- fs hypequery-hypequery-806e5c4/packages/cli/src/commands/live-source.ts :2
import { mkdir, rename, rm, stat, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/mcp.test.ts :1
import { mkdtemp, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/generators/dataset-generator.test.ts :2
import { mkdtemp, readFile, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/generators/dataset-generator.ts :8
import fs from 'fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/packaging.test.ts :2
import { readFileSync, readdirSync } from 'node:fs'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/templates/scaffold-node-next.test.ts :1
import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/typegen/generate-types.test.ts :2
import { mkdtemp, readFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/typegen/generate-types.ts :14
import fs from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/cloud-credential-store.test.ts :1
import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/cloud-credential-store.ts :2
import { chmod, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/dependency-installer.test.ts :2
import { readFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/dependency-installer.ts :1
import { existsSync } from 'node:fs'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-bundle.test.ts :8
} from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-bundle.ts :11
} from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-source-snapshot.test.ts :2
import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-source-snapshot.ts :2
import { constants, lstat, open, realpath } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-upload.test.ts :1
import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-upload.ts :2
import { constants, open } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/detect-database.test.ts :2
import { access, readFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/detect-database.ts :1
import { access, readFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/find-files.test.ts :2
import { access } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/find-files.ts :1
import { access } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/generated-file.test.ts :1
import { chmod, mkdtemp, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/generated-file.ts :2
import { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/git-branch.test.ts :2
import { mkdirSync, mkdtempSync, rmSync } from 'node:fs'; - fs (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/load-api.test.ts :2
import { access } from 'node:fs/promises'; - fs hypequery-hypequery-806e5c4/packages/cli/src/utils/load-api.ts :2
import { access, mkdtemp, rm, mkdir, writeFile } from 'node:fs/promises'; - fs (weak) hypequery-hypequery-806e5c4/packages/clickhouse/scripts/diagnose-ci.js :13
import fs from 'fs';
54 more not shown — this panel samples each group; the count above is the real total.
shell / exec 15
- shell (weak) hypequery-hypequery-806e5c4/packages/cli/src/generators/dataset-generator.test.ts :1
import { execFile } from 'node:child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/cli/src/templates/scaffold-node-next.test.ts :20
const { execFile } = await import('node:child_process'); - shell hypequery-hypequery-806e5c4/packages/cli/src/utils/dependency-installer.ts :4
import { spawn } from 'node:child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-source-snapshot.test.ts :1
import { execFileSync } from 'node:child_process'; - shell hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-source-snapshot.ts :1
import { execFile } from 'node:child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/git-branch.test.ts :1
import { execFileSync } from 'node:child_process'; - shell hypequery-hypequery-806e5c4/packages/cli/src/utils/git-branch.ts :1
import { execFile } from 'node:child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/clickhouse/scripts/diagnose-ci.js :16
import { execSync } from 'child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/clickhouse/scripts/run-integration-tests.js :3
import { spawn } from 'node:child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/clickhouse/scripts/test-cli-integration.js :3
import { execSync } from 'child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/clickhouse/scripts/test-consolidation.js :15
import { execSync } from 'child_process'; - shell (weak) hypequery-hypequery-806e5c4/packages/clickhouse/type-tests/datasets-protocol.test.ts :43
const rejectedClient: QueryBuilderFactoryInput = { query() { }, exec() { } };
show 3 more
- shell (weak) hypequery-hypequery-806e5c4/packages/datasets/scripts/run-integration-tests.js :3
import { spawn } from 'node:child_process'; - shell hypequery-hypequery-806e5c4/packages/protocol-conformance/src/runner.ts :4
import { type ChildProcessWithoutNullStreams, spawn } from 'node:child_process'; - shell (weak) hypequery-hypequery-806e5c4/testing/clickhouse/harness.mjs :5
import { spawn } from 'node:child_process';
network 18
- net (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/login.test.ts :32
return fetch(callback); - net hypequery-hypequery-806e5c4/packages/cli/src/commands/login.ts :2
import { createServer } from 'node:http'; - net hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-upload.ts :445
fetch(input, init as never) as Promise<DeploymentHttpResponse> - net (weak) hypequery-hypequery-806e5c4/packages/deployment/src/control-plane-adapters.test.ts :1
import { createServer } from 'node:http'; - net hypequery-hypequery-806e5c4/packages/deployment/src/control-plane-adapters.ts :1
import type { IncomingMessage, ServerResponse } from 'node:http'; - net (weak) hypequery-hypequery-806e5c4/packages/deployment/src/data-plane-adapters.test.ts :1
import { createServer } from 'node:http'; - net hypequery-hypequery-806e5c4/packages/deployment/src/data-plane-adapters.ts :1
import type { IncomingMessage, ServerResponse } from 'node:http'; - net (weak) hypequery-hypequery-806e5c4/packages/serve/src/adapters/node.test.ts :1
import { request as httpRequest } from "http"; - net hypequery-hypequery-806e5c4/packages/serve/src/adapters/node.ts :1
import { createServer, type IncomingMessage, type ServerResponse } from "http"; - net (weak) hypequery-hypequery-806e5c4/packages/serve/src/auth-jwt.test.ts :2
import { createServer, type Server } from "node:http"; - net hypequery-hypequery-806e5c4/packages/serve/src/client-config.ts :33
* const config = await fetch('/api/config').then(r => r.json()); - net hypequery-hypequery-806e5c4/packages/serve/src/dev.ts :1
import type { AddressInfo } from "net";
show 6 more
- net (weak) hypequery-hypequery-806e5c4/scripts/verify-seo-health.ts :276
return fetch(url, { - net (weak) hypequery-hypequery-806e5c4/testing/clickhouse/harness.mjs :2
import net from 'node:net'; - net hypequery-hypequery-806e5c4/website-next/src/app/clickhouse-analytics/page.tsx :47
const httpResult = await fetch('/api/analytics/active-users'); - net hypequery-hypequery-806e5c4/website-next/src/app/clickhouse-semantic-layer/page.tsx :96
await fetch('/api/analytics/metrics/revenue', { - net hypequery-hypequery-806e5c4/website-next/src/components/page-actions.tsx :30
'text/plain': fetch(markdownUrl).then(async (res) => { - net hypequery-hypequery-806e5c4/website-next/src/data/compare-articles.ts :81
gion = '${region}' FORMAT JSON`;\nawait fetch(`http://localhost:8123/?query=${encodeURIComponent(sql)}`);\n```\n\nThat interpolation is a SQL injection hole, and even when it isn't malicious it's an e
secrets 26
- secrets hypequery-hypequery-806e5c4/packages/cli/src/commands/generate.ts :167
logger.indent('CLICKHOUSE_PASSWORD=' + (process.env.CLICKHOUSE_PASSWORD ? '***' : 'not set')); - secrets (weak) hypequery-hypequery-806e5c4/packages/cli/src/commands/init.test.ts :344
process.env.CLICKHOUSE_PASSWORD = 'test_pass'; - secrets hypequery-hypequery-806e5c4/packages/cli/src/commands/init.ts :141
password: process.env.CLICKHOUSE_PASSWORD ?? '', - secrets hypequery-hypequery-806e5c4/packages/cli/src/templates/client.ts :40
password: process.env.CLICKHOUSE_PASSWORD, - secrets (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/clickhouse-client.test.ts :20
delete process.env.CLICKHOUSE_PASSWORD; - secrets (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/detect-database.test.ts :38
delete process.env.CLICKHOUSE_PASSWORD; - secrets hypequery-hypequery-806e5c4/packages/cli/src/utils/detect-database.ts :32
if (process.env.BIGQUERY_PROJECT_ID || process.env.GOOGLE_APPLICATION_CREDENTIALS) { - secrets (weak) hypequery-hypequery-806e5c4/packages/cli/src/utils/prompts.test.ts :187
delete process.env.CLICKHOUSE_PASSWORD; - secrets hypequery-hypequery-806e5c4/packages/cli/src/utils/prompts.ts :85
initial: process.env.CLICKHOUSE_PASSWORD ?? '', - secrets hypequery-hypequery-806e5c4/packages/clickhouse/src/cli/bin.js :217
process.env.CLICKHOUSE_PASSWORD || - secrets hypequery-hypequery-806e5c4/packages/clickhouse/src/datasets.ts :21
* password: process.env.CLICKHOUSE_PASSWORD, - secrets (weak) hypequery-hypequery-806e5c4/packages/datasets/scripts/run-integration-tests.js :30
password: process.env.CLICKHOUSE_TEST_PASSWORD || TEST_CONNECTION_CONFIG.password,
show 14 more
- secrets (weak) hypequery-hypequery-806e5c4/packages/mcp-server/examples/mcp-config.js :24
password: process.env.CLICKHOUSE_PASSWORD || '', - secrets (weak) hypequery-hypequery-806e5c4/packages/mcp-server/examples/mcp-config.ts :30
password: process.env.CLICKHOUSE_PASSWORD || '', - secrets (weak) hypequery-hypequery-806e5c4/packages/mcp-server/examples/system-one-config.js :25
password: process.env.CLICKHOUSE_PASSWORD || '', - secrets (weak) hypequery-hypequery-806e5c4/testing/clickhouse/harness.mjs :23
password: process.env.CLICKHOUSE_TEST_PASSWORD || 'hypequery_test', - secrets hypequery-hypequery-806e5c4/website-next/src/app/clickhouse-nodejs/page.tsx :33
password: process.env.CLICKHOUSE_PASSWORD!, - secrets hypequery-hypequery-806e5c4/website-next/src/app/type-safe-sql-typescript/page.tsx :54
password: process.env.CLICKHOUSE_PASSWORD, - secrets hypequery-hypequery-806e5c4/website-next/src/components/home/constants.ts :426
password: process.env.CLICKHOUSE_PASSWORD, - secrets hypequery-hypequery-806e5c4/website-next/src/data/ai-context.ts :26
password: process.env.CLICKHOUSE_PASSWORD ?? '', - secrets hypequery-hypequery-806e5c4/website-next/src/data/clickhouse-functions.ts :60
password: process.env.CLICKHOUSE_PASSWORD!, - secrets hypequery-hypequery-806e5c4/website-next/src/data/compare-articles.ts :61
.env.CLICKHOUSE_USERNAME!,\n password: process.env.CLICKHOUSE_PASSWORD,\n database: process.env.CLICKHOUSE_DATABASE!,\n});\n\nconst revenueByDay = await db\n .table('orders')\n .where('tenant_id', - secrets hypequery-hypequery-806e5c4/website-next/src/lib/blog-cms.ts :81
return typeof process.env.BLOB_READ_WRITE_TOKEN === 'string' && process.env.BLOB_READ_WRITE_TOKEN.length > 0; - secrets hypequery-hypequery-806e5c4/website-next/src/lib/cms-auth.ts :7
return process.env.CMS_ADMIN_PASSWORD ?? ''; - secrets (weak) hypequery-hypequery-806e5c4/website-next/test-blog-routes.mjs :97
const hasBlobToken = !!process.env.BLOB_READ_WRITE_TOKEN; - secrets (weak) hypequery-hypequery-806e5c4/website-next/test-blog.js :63
const hasBlobToken = !!process.env.BLOB_READ_WRITE_TOKEN;
install hooks 2
- prepack hypequery-hypequery-806e5c4/packages/mcp-server/package.json :36
npm run build - prepack hypequery-hypequery-806e5c4/packages/react/package.json :35
pnpm build
declared dependencies 7
- @changesets/cli@^2.29.8
- @type-challenges/utils@^0.1.1
- @typescript-eslint/eslint-plugin@^8.62.1
- @typescript-eslint/parser@^8.62.1
- eslint@^8.0.0
- turbo@^2.9.14
- typescript@^5.9.3
obfuscation 1
- dynamic require()/import() hypequery-hypequery-806e5c4/packages/cli/src/utils/deployment-runtime-artifact.test.ts :59
const runtime = await import(`data:text/javascript;base64,${encoded}`);
perm:untrusted 1
- untrusted hypequery-hypequery-806e5c4/website-next/src/components/page-actions.tsx :30
'text/plain': fetch(markdownUrl).then(async (res) => {
transport_posture 2
- network-listening, binds all interfaces, no auth detected hypequery-hypequery-806e5c4/packages/cli/src/commands/dev.test.ts :235
hostname: '0.0.0.0', - network-listening, binds all interfaces, no auth detected hypequery-hypequery-806e5c4/testing/clickhouse/harness.mjs :143
tester.listen(port, '0.0.0.0');