github analyzed bcefb0f

igorzheludkov/execbro

Gives AI agents eyes and hands into running React Native apps: logs, REPL, tap, screenshots

maintainer: igorzheludkov
license: —
first seen: 2026-08-01
last seen: 2026-08-01
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-08-01 code analysis flagged dynamic code execution ×7 in igorzheludkov/execbro

capabilities 0 tools

transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit bcefb0f · analyzer v28 · 1d ago

skills & prompt files 1

agent-rules igorzheludkov-execbro-bcefb0f/CLAUDE.md

danger signals8

dynamic code execution new Function() igorzheludkov-execbro-bcefb0f/src/__tests__/unit/appContext.test.ts :8 const run = new Function("globalThis", source + "; return (" + expr + ");");
dynamic code execution new Function() igorzheludkov-execbro-bcefb0f/src/__tests__/unit/appRequest.test.ts :45 expect(() => new Function("return " + src.replace(/^\(function/, "(function"))).not.toThrow();
dynamic code execution new Function() igorzheludkov-execbro-bcefb0f/src/__tests__/unit/moduleRegistry.test.ts :32 const run = new Function("globalThis", source + "; return __eb_require;");
dynamic code execution new Function() igorzheludkov-execbro-bcefb0f/src/__tests__/unit/navigation.test.ts :13 const run = new Function("globalThis", source + "; return __eb_nav;");
dynamic code execution new Function() igorzheludkov-execbro-bcefb0f/src/__tests__/unit/promiseHandles.test.ts :50 const run = new Function("globalThis", "return " + src + ";");
dynamic code execution new Function() igorzheludkov-execbro-bcefb0f/src/__tests__/unit/visibility.test.ts :51 const injected = new Function(`${VISIBILITY_HELPERS_JS}; return isHiddenNavigationScene;`)() as (
dynamic code execution new Function() igorzheludkov-execbro-bcefb0f/src/__tests__/unit/waitForMeasurements.test.ts :77 const value = new Function("globalThis", `return ${expr};`)(globalThisStub);
suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose igorzheludkov-execbro-bcefb0f/src/core/posthog.ts :7 const host = "https://us.i.posthog.com";

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 217

filesystem 15

fs igorzheludkov-execbro-bcefb0f/src/core/android.ts :1 import { existsSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/config.ts :1 import { readFileSync, existsSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/feedback.ts :1 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/fingerprint.ts :4 import { readFileSync, existsSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/ios.ts :3 import { existsSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/license.ts :1 import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/ocr.ts :3 import { writeFile, unlink } from "fs/promises";
fs igorzheludkov-execbro-bcefb0f/src/core/paths.ts :1 import { existsSync, renameSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/posthog.ts :2 import { existsSync, readFileSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/projectStore.ts :9 } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/telemetry.ts :2 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, unlinkSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/core/usageCache.ts :1 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/pro/usageNotifications.ts :1 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/tools/accountTools.ts :6 import { existsSync, unlinkSync } from "fs";
fs igorzheludkov-execbro-bcefb0f/src/tools/metaTools.ts :4 import { existsSync, unlinkSync } from "fs";

shell / exec 4

shell igorzheludkov-execbro-bcefb0f/src/core/exec.ts :1 import { exec, ExecOptions } from "node:child_process";
shell igorzheludkov-execbro-bcefb0f/src/core/fingerprint.ts :3 import { execSync } from "child_process";
shell igorzheludkov-execbro-bcefb0f/src/core/ios.ts :1 import { execFile } from "child_process";
shell igorzheludkov-execbro-bcefb0f/src/core/ocr.ts :7 import { spawn } from "child_process";

network 11

net igorzheludkov-execbro-bcefb0f/src/core/appRequest.ts :89 return fetch(${url}, init).then(function (res) {
net igorzheludkov-execbro-bcefb0f/src/core/bundle.ts :355 const response = await fetch(`http://localhost:${port}/status`);
net igorzheludkov-execbro-bcefb0f/src/core/failureArtifact.ts :113 const res = await fetch(url, {
net igorzheludkov-execbro-bcefb0f/src/core/license.ts :210 const response = await fetch(`${VALIDATION_ENDPOINT}/api/license/validate`, {
net igorzheludkov-execbro-bcefb0f/src/core/metro.ts :1 import * as net from "net";
net igorzheludkov-execbro-bcefb0f/src/core/ocr.ts :285 response = await fetch(`${OCR_ENDPOINT}/ocr`, {
net igorzheludkov-execbro-bcefb0f/src/core/symbolicate.ts :101 const res = await fetch(endpoint, {
net igorzheludkov-execbro-bcefb0f/src/core/telemetry.ts :862 fetch(TELEMETRY_ENDPOINT, {
net igorzheludkov-execbro-bcefb0f/src/index.ts :6 import { createServer as createHttpServer } from "node:http";
net igorzheludkov-execbro-bcefb0f/src/tools/accountTools.ts :43 const response = await fetch(`${API_URL}/api/accounts/activate`, {
net igorzheludkov-execbro-bcefb0f/src/tools/executionTools.ts :25 "BAD examples: `await fetch(...)` (bare top-level await), `require('react-native')`\n" +

declared dependencies 15

@modelcontextprotocol/sdk@^1.25.1
fast-xml-parser@^5.3.3
node-easyocr@^1.0.9
pixelmatch@^7.1.0
posthog-node@^5.28.11
sharp@^0.34.5
ws@^8.18.3
zod@^3.25.76
@types/jest@^30.0.0
@types/node@^25.0.3
@types/ws@^8.18.1
jest@^30.2.0
nodemon@^3.1.11
ts-jest@^29.4.6
typescript@^5.9.3

perm:untrusted 1

untrusted igorzheludkov-execbro-bcefb0f/src/core/appRequest.ts :89 return fetch(${url}, init).then(function (res) {