Claude records the manual steps only you can do — a form in some console, a secret to seed, a review to answer — in local SQLite, and you work through them on a board that looks different for every project.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 21 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
add_project_path
-
add_steps
-
complete_steps
-
complete_task
-
create_project
-
create_task
-
delete_step
-
delete_task
-
get_task
-
link_projects
-
link_tasks
-
list_projects
-
list_tasks
-
open_board
-
reopen_steps
-
set_locale
-
set_project_theme
-
update_project
-
update_step
-
update_task
-
where_am_i
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 30522e3 · analyzer v33 · 1w ago
skills & prompt files 1
danger signals1
- suspicious endpoint sentry.io (telemetry) javirub-claude-manual-todos-plugin-30522e3/scripts/seed-demo.ts :233
linkUrl: "https://sentry.io/settings/auth-tokens/",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 58
filesystem 5
- fs javirub-claude-manual-todos-plugin-30522e3/bin/todos.ts :15
import { existsSync, mkdirSync, openSync, readFileSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs"; - fs javirub-claude-manual-todos-plugin-30522e3/mcp/preflight.ts :10
import { existsSync } from "node:fs"; - fs (weak) javirub-claude-manual-todos-plugin-30522e3/scripts/seed-demo.ts :24
import { rmSync } from "node:fs"; - fs (weak) javirub-claude-manual-todos-plugin-30522e3/scripts/shots.ts :29
import { mkdirSync, rmSync, writeFileSync } from "node:fs"; - fs javirub-claude-manual-todos-plugin-30522e3/src/lib/db/index.ts :1
import { mkdirSync } from "node:fs";
shell / exec 6
- shell javirub-claude-manual-todos-plugin-30522e3/bin/todos.ts :14
import { spawn, spawnSync } from "node:child_process"; - shell javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :605
const { spawn } = await import("node:child_process"); - shell javirub-claude-manual-todos-plugin-30522e3/mcp/preflight.ts :9
import { spawnSync } from "node:child_process"; - shell (weak) javirub-claude-manual-todos-plugin-30522e3/scripts/mcp-smoke.ts :16
import { spawn } from "node:child_process"; - shell (weak) javirub-claude-manual-todos-plugin-30522e3/scripts/shots.ts :28
import { spawn, spawnSync, type ChildProcess } from "node:child_process"; - shell javirub-claude-manual-todos-plugin-30522e3/src/lib/db/driver.ts :31
exec(sql: string): void;
network 3
- net javirub-claude-manual-todos-plugin-30522e3/bin/todos.ts :40
const response = await fetch(`${boardOrigin()}/api/health`, { - net javirub-claude-manual-todos-plugin-30522e3/hooks/session-start.ts :25
const up = await fetch(`${boardOrigin()}/api/health`, { signal: AbortSignal.timeout(300) }) - net (weak) javirub-claude-manual-todos-plugin-30522e3/scripts/shots.ts :188
const r = await fetch(`${ORIGIN}/api/health`, { signal: AbortSignal.timeout(800) });
tool registrations 21
- where_am_i javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :113
- list_projects javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :158
- create_project javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :172
- update_project javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :214
- add_project_path javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :234
- link_projects javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :258
- set_project_theme javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :278
- set_locale javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :298
- list_tasks javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :316
- get_task javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :351
- create_task javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :367
- update_task javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :401
show 9 more
- add_steps javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :426
- update_step javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :447
- complete_steps javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :473
- reopen_steps javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :493
- complete_task javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :507
- delete_step javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :521
- delete_task javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :536
- link_tasks javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :553
- open_board javirub-claude-manual-todos-plugin-30522e3/mcp/main.ts :577
declared dependencies 13
- @modelcontextprotocol/server@^2.0.0
- next@^16.3.4
- next-intl@^4.14.2
- react@^19.2.8
- react-dom@^19.2.8
- zod@^4.5.4
- @eloqnt/cli@^0.6.29
- @types/bun@^1.4.0
- @types/node@^26.4.1
- @types/react@^19.2.18
- @types/react-dom@^19.2.7
- playwright-core@^1.50.0
show 1 more
- typescript@^7.0.2