Source-available Harness AI / Agent OS for teams building governed agent applications - with Nexus orchestration, policy-controlled tools, RAG, memory, trace/evidence, HITL, and runtime boundaries.
D high
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 12
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 4m ago · see ecosystem CVEs →
- C · 59 → D · 67
- C · 35 → C · 59
- A · 0 → C · 35
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: Slack token · dynamic exec: pickle.loads(), __import__()
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d9e69c5 · analyzer v28 · 2d ago
skills & prompt files 20
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/README.md
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/intergrax-ci-hotfix.mdc
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/intergrax-hep-step.mdc
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/intergrax-idea-audit.mdc
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/intergrax-implementation-journal.mdc
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/intergrax-iteration.mdc
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/intergrax-micro-implement.mdc
- agent-rules jakbuczarnecki-intergrax-d9e69c5/.cursor/rules/intergrax-token-budget.mdc
- agent-rules jakbuczarnecki-intergrax-d9e69c5/AGENTS.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/dispute_analyst/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/dispute_intake/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/dispute_scenario/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/dispute_strategist/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/external_contractor_adapter/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/intergrax_assistant/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/legal/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/local_indexer/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/local_search/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/local_synthesizer/prompts/system.md
- prompt-file jakbuczarnecki-intergrax-d9e69c5/agents/signoff_probe/prompts/system.md
danger signals15
- dynamic code execution pickle.loads() jakbuczarnecki-intergrax-d9e69c5/intergrax/distributed/providers/redis_idempotency_store.py :118
return pickle.loads(raw) - dynamic code execution pickle.loads() jakbuczarnecki-intergrax-d9e69c5/intergrax/runtime/tools/sqlite_idempotency_store.py :158
return pickle.loads(base64.b64decode(result_blob.encode("ascii"))) - dynamic code execution __import__() jakbuczarnecki-intergrax-d9e69c5/scripts/docs/generate_sk_exp5_usage.py :43
__import__( - dynamic code execution __import__() jakbuczarnecki-intergrax-d9e69c5/tests/unit/hosting/engine/test_engine_failures.py :47
shutdown=__import__( - dynamic code execution __import__() jakbuczarnecki-intergrax-d9e69c5/tests/unit/hosting/engine/test_engine_w2_invariants.py :56
shutdown=__import__( - suspicious endpoint sentry.io (telemetry)
expected for this server's purpose
jakbuczarnecki-intergrax-d9e69c5/intergrax/integrations/_shared/p3/configs.py :151
base_url: str = "https://sentry.io" - suspicious endpoint api.datadoghq.com (telemetry) jakbuczarnecki-intergrax-d9e69c5/intergrax/integrations/_shared/p3/factories.py :339
base = config.base_url or "https://api.datadoghq.com" - suspicious endpoint app.posthog.com (telemetry) jakbuczarnecki-intergrax-d9e69c5/intergrax/integrations/_shared/p4/factories.py :148
default_url="https://app.posthog.com", - suspicious endpoint api.telegram.org jakbuczarnecki-intergrax-d9e69c5/intergrax/integrations/_shared/p8/factories.py :343
http = _open_httpx_client(config, default_url=config.base_url or "https://api.telegram.org") - suspicious endpoint 93.184.216.34 jakbuczarnecki-intergrax-d9e69c5/tests/unit/websearch/capture/test_url_policy.py :215
policy.canonicalize("https://93.184.216.34/") - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform jakbuczarnecki-intergrax-d9e69c5/intergrax/integrations/providers/cloud_platform/gcp/opens.py :22
_GCP_CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform" - committed secret Slack token jakbuczarnecki-intergrax-d9e69c5/applications/local_workspace_application/tests/conversation/test_interaction_planner.py :663
xoxb-s…(16 chars, redacted) - committed secret Slack token jakbuczarnecki-intergrax-d9e69c5/applications/local_workspace_application/tests/scripts/test_slack_ask_configuration_preflight.py :60
xoxb-s…(23 chars, redacted) - committed secret Slack token jakbuczarnecki-intergrax-d9e69c5/tests/unit/integrations/providers/conversation_channel/slack/test_config.py :47
xoxb-w…(17 chars, redacted) - committed secret Slack token jakbuczarnecki-intergrax-d9e69c5/tests/unit/integrations/providers/conversation_channel/slack/test_live_proof_env.py :101
xoxb-p…(17 chars, redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:jakbuczarnecki/intergrax/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of jakbuczarnecki.