MCP Observatory
3m ago Tracked 26,758 Last 3m ago 24h 1,572
github TypeScript analyzed bfc4f88

joiha-steven/quireink

github

A self-hosted blog platform an AI agent can run for you. One Bun process, two SQLite files, no cloud account anywhere in the path.

maintainer
joiha-steven
license
NOASSERTION
first seen
2026-07-31
last seen
2026-08-02
releases · 30d
7
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit bfc4f88 · analyzer v28 · 2d ago

skills & prompt files 3

danger signals3

code evidence vv2.0.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 768

filesystem 9

  • fs joiha-steven-quireink-bfc4f88/golden/capture-corpus.ts :17 import { readdirSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs'
  • fs joiha-steven-quireink-bfc4f88/src/media/blob-local.ts :10 import { promises as fs, createReadStream, mkdirSync } from 'node:fs'
  • fs joiha-steven-quireink-bfc4f88/src/server/backup.ts :19 import { mkdtemp, readdir, rm, stat, mkdir } from 'node:fs/promises'
  • fs joiha-steven-quireink-bfc4f88/src/server/build-info.ts :14 import { readFileSync } from 'node:fs'
  • fs joiha-steven-quireink-bfc4f88/src/store/db.ts :12 import { mkdirSync } from 'node:fs'
  • fs joiha-steven-quireink-bfc4f88/src/web/admin/backup.ts :13 import { mkdtemp, rm } from 'node:fs/promises'
  • fs joiha-steven-quireink-bfc4f88/src/web/admin/spa.ts :13 import { readdirSync, readFileSync } from 'node:fs'
  • fs joiha-steven-quireink-bfc4f88/v1/src/lib/backup.ts :7 import { promises as fs } from 'node:fs'
  • fs joiha-steven-quireink-bfc4f88/v1/src/lib/blob-local.ts :10 import { promises as fs, createReadStream } from 'node:fs'

shell / exec 1

  • shell joiha-steven-quireink-bfc4f88/src/server/backup.ts :88 const proc = Bun.spawn(['tar', ...args], { stdout: 'pipe', stderr: 'pipe' })

network 78

  • net joiha-steven-quireink-bfc4f88/src/admin/App.tsx :129 await fetch('/api/auth/logout', { method: 'POST' })
  • net joiha-steven-quireink-bfc4f88/src/admin/api.ts :24 const res = await fetch(url, {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/ActivityLog.tsx :23 const res = await fetch('/api/activity', { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/CacheButton.tsx :29 const res = await fetch('/api/cache/clear', { method: 'POST' })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/CloudflareFields.tsx :36 const res = await fetch('/api/integrations/cloudflare', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/CommentIntegrations.tsx :77 const res = await fetch('/api/comments/keys', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/CommentsTable.tsx :30 const res = await fetch(`/api/comments/${id}`, { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/ExportFields.tsx :54 const res = await fetch('/api/backup/list')
  • net joiha-steven-quireink-bfc4f88/src/admin/components/FileLibrary.tsx :32 fetch('/api/files').then((r) => r.json() as Promise<ApiResponse<FileItem[]>>),
  • net joiha-steven-quireink-bfc4f88/src/admin/components/FontUpload.tsx :40 const res = await fetch('/api/files/font', { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/IconUpload.tsx :30 const res = await fetch('/api/files/upload', { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/ImportFields.tsx :28 const res = await fetch('/api/import/wordpress', { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/McpFields.tsx :36 const res = await fetch('/api/mcp/tokens')
  • net joiha-steven-quireink-bfc4f88/src/admin/components/MediaLibrary.tsx :49 fetch('/api/media')
  • net joiha-steven-quireink-bfc4f88/src/admin/components/NewsletterFields.tsx :29 fetch('/api/mail')
  • net joiha-steven-quireink-bfc4f88/src/admin/components/NewsletterSend.tsx :52 fetch(`/api/broadcast?${qs}`, { signal: ctrl.signal })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/NewsletterSubscribers.tsx :28 fetch('/api/subscribers')
  • net joiha-steven-quireink-bfc4f88/src/admin/components/NewsletterTest.tsx :23 const res = await fetch('/api/mail/test', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/PageForm.tsx :92 const res = await fetch(editing ? `/api/pages/${editing}` : '/api/pages', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/PagesTable.tsx :20 const res = await fetch(`/api/pages/${slug}`, { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/PostForm.tsx :152 const res = await fetch(editing ? `/api/posts/${editing}` : '/api/posts', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/PostsTable.tsx :36 const res = await fetch(`/api/posts/${slug}`, { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/src/admin/components/RedirectsManager.tsx :23 const res = await fetch('/api/redirects')
  • net joiha-steven-quireink-bfc4f88/src/admin/components/SeriesManager.tsx :37 const res = await fetch('/api/series', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/SettingsView.tsx :100 const res = await fetch('/api/settings', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/TaxonomyManager.tsx :85 const res = await fetch('/api/taxonomy', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/TimeMachine.tsx :29 fetch(`/api/posts/${encodeURIComponent(slug)}/revisions`)
  • net joiha-steven-quireink-bfc4f88/src/admin/components/TrashView.tsx :64 const res = await fetch('/api/trash', {
  • net joiha-steven-quireink-bfc4f88/src/admin/components/VideoLibrary.tsx :24 fetch('/api/files')
  • net joiha-steven-quireink-bfc4f88/src/assets/js/comments.ts :122 await fetch('/comment-auth/signout', { method: 'POST' }).catch(() => {})
  • net joiha-steven-quireink-bfc4f88/src/assets/js/search.ts :74 const res = await fetch(`/api/search?q=${encodeURIComponent(query)}`)
  • net joiha-steven-quireink-bfc4f88/src/assets/js/subscribe.ts :33 const res = await fetch('/api/subscribe', {
  • net joiha-steven-quireink-bfc4f88/src/assets/js/track.ts :16 fetch('/api/track', {
  • net joiha-steven-quireink-bfc4f88/src/auth/turnstile.ts :17 const res = await fetch(SITEVERIFY, { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/src/comments/google-oauth.ts :99 const res = await fetch(TOKEN, {
  • net joiha-steven-quireink-bfc4f88/src/server/edge-cache.ts :33 const res = await fetch(`${ENDPOINT}/${keys.cloudflareZoneId}/purge_cache`, {
  • net joiha-steven-quireink-bfc4f88/src/server/safe-fetch.ts :10 import { isIP } from 'node:net'
  • net joiha-steven-quireink-bfc4f88/v1/src/app/og/route.tsx :7 // Edge runtime: fetch(new URL('./font.woff', import.meta.url)) only resolves the
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/ActivityLog.tsx :25 const res = await fetch('/api/activity', { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/BackupFields.tsx :38 const res = await fetch('/api/backup')
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/CacheButton.tsx :31 const res = await fetch('/api/cache/clear', { method: 'POST' })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/CloudflareFields.tsx :38 const res = await fetch('/api/integrations/cloudflare', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/CommentKeys.tsx :60 const res = await fetch('/api/comments/keys', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/CommentsTable.tsx :32 const res = await fetch(`/api/comments/${id}`, { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/FileLibrary.tsx :34 fetch('/api/files').then((r) => r.json() as Promise<ApiResponse<FileItem[]>>),
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/FontUpload.tsx :41 const res = await fetch('/api/files/font', { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/IconUpload.tsx :32 const res = await fetch('/api/files/upload', { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/ImportFields.tsx :30 const res = await fetch('/api/import/wordpress', { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/McpFields.tsx :29 const res = await fetch('/api/mcp/tokens')
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/MediaLibrary.tsx :51 fetch('/api/media')
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/NewsletterFields.tsx :30 fetch('/api/mail')
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/NewsletterSend.tsx :54 fetch(`/api/broadcast?${qs}`, { signal: ctrl.signal })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/NewsletterSubscribers.tsx :30 fetch('/api/subscribers')
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/NewsletterTest.tsx :25 const res = await fetch('/api/mail/test', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/PageForm.tsx :93 const res = await fetch(editing ? `/api/pages/${editing}` : '/api/pages', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/PagesTable.tsx :21 const res = await fetch(`/api/pages/${slug}`, { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/PostForm.tsx :153 const res = await fetch(editing ? `/api/posts/${editing}` : '/api/posts', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/PostsTable.tsx :37 const res = await fetch(`/api/posts/${slug}`, { method: 'DELETE' })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/RedirectsManager.tsx :25 const res = await fetch('/api/redirects')
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/SeriesManager.tsx :39 const res = await fetch('/api/series', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/SettingsView.tsx :58 const res = await fetch('/api/settings', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/TaxonomyManager.tsx :87 const res = await fetch('/api/taxonomy', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/TimeMachine.tsx :30 fetch(`/api/posts/${encodeURIComponent(slug)}/revisions`)
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/TrashView.tsx :66 const res = await fetch('/api/trash', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/admin/VideoLibrary.tsx :26 fetch('/api/files')
  • net joiha-steven-quireink-bfc4f88/v1/src/components/blog/Comments.tsx :51 const res = await fetch(`/api/comments?post=${encodeURIComponent(postSlug)}`, { cache: 'no-store' })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/blog/ScrollDepth.tsx :43 else fetch('/api/track', { method: 'POST', body, headers: { 'Content-Type': 'application/json' }, keepalive: true })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/blog/SearchClient.tsx :41 const res = await fetch(`/api/search?q=${encodeURIComponent(trimmed)}`, { signal: ctrl.signal })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/blog/SearchOverlay.tsx :28 fetch('/api/search/index', { signal: ctrl.signal })
  • net joiha-steven-quireink-bfc4f88/v1/src/components/blog/SubscribeForm.tsx :23 const res = await fetch('/api/subscribe', {
  • net joiha-steven-quireink-bfc4f88/v1/src/components/blog/Track.tsx :40 fetch('/api/track', { method: 'POST', body, headers: { 'Content-Type': 'application/json' }, keepalive: true })
  • net joiha-steven-quireink-bfc4f88/v1/src/lib/cdn.ts :15 const res = await fetch(
  • net joiha-steven-quireink-bfc4f88/v1/src/lib/db.ts :35 return fetch(input, { ...init, next: { revalidate: REVALIDATE, tags: [DB_TAG] } })
  • net joiha-steven-quireink-bfc4f88/v1/src/lib/gdrive.ts :68 const res = await fetch(TOKEN_URL, {
  • net joiha-steven-quireink-bfc4f88/v1/src/lib/revalidate.ts :90 paths.map((p) => fetch(`${LOCAL_ORIGIN}${p}`, { cache: 'no-store' })),
  • net joiha-steven-quireink-bfc4f88/v1/src/lib/safe-fetch.ts :10 import { isIP } from 'node:net'
  • net joiha-steven-quireink-bfc4f88/v1/src/lib/turnstile.ts :17 const res = await fetch(SITEVERIFY, { method: 'POST', body })
  • net joiha-steven-quireink-bfc4f88/v1/src/middleware.ts :17 // path, refreshed from PostgREST at most once per TTL. Edge-safe: a plain fetch (NOT

secrets 13

  • secrets joiha-steven-quireink-bfc4f88/src/analytics/record.ts :38 // The salt was `process.env.AUTH_SECRET ?? 'quire'`. `AUTH_SECRET` leaves with next-auth
  • secrets joiha-steven-quireink-bfc4f88/src/content/preview.ts :5 // The key was `process.env.AUTH_SECRET ?? ''`. `AUTH_SECRET` left with next-auth
  • secrets joiha-steven-quireink-bfc4f88/src/mcp/auth.ts :28 const secret = (): string => process.env.MCP_OAUTH_SECRET || serverSecret('mcp-oauth')
  • secrets joiha-steven-quireink-bfc4f88/src/mcp/consent.ts :22 const secret = (): string => process.env.MCP_OAUTH_SECRET || serverSecret('mcp-oauth')
  • secrets joiha-steven-quireink-bfc4f88/src/web/admin/ops.ts :142 const secret = process.env.CRON_SECRET
  • secrets joiha-steven-quireink-bfc4f88/v1/src/app/api/cron/route.ts :34 const secret = process.env.CRON_SECRET
  • secrets joiha-steven-quireink-bfc4f88/v1/src/lib/analytics.ts :97 const salt = process.env.AUTH_SECRET ?? 'quire'
  • secrets joiha-steven-quireink-bfc4f88/v1/src/lib/db.ts :51 const token = process.env.POSTGREST_TOKEN
  • secrets joiha-steven-quireink-bfc4f88/v1/src/lib/gdrive.ts :24 const secret = process.env.AUTH_GOOGLE_SECRET
  • secrets joiha-steven-quireink-bfc4f88/v1/src/lib/mcp/auth.ts :15 const secret = (): string => process.env.MCP_OAUTH_SECRET || process.env.AUTH_SECRET || ''
  • secrets joiha-steven-quireink-bfc4f88/v1/src/lib/mcp/consent.ts :16 const secret = (): string => process.env.MCP_OAUTH_SECRET || process.env.AUTH_SECRET || ''
  • secrets joiha-steven-quireink-bfc4f88/v1/src/lib/preview.ts :7 const secret = process.env.AUTH_SECRET ?? ''
  • secrets joiha-steven-quireink-bfc4f88/v1/src/middleware.ts :26 const token = process.env.POSTGREST_TOKEN

declared dependencies 31

  • @modelcontextprotocol/sdk@^1.26.0
  • fast-xml-parser@^5.10.1
  • hono@^4.12.32
  • marked@18.0.5
  • nodemailer@^9.0.3
  • qrcode-generator@^2.0.4
  • satori@^0.29.0
  • sharp@^0.35.3
  • shiki@4.2.0
  • turndown@^7.2.4
  • turndown-plugin-gfm@^1.0.2
  • zod@^4.4.3
  • @happy-dom/global-registrator@^20.11.1
  • @supabase/postgrest-js@^2.110.8
  • @tailwindcss/cli@^4
  • @tiptap/extension-image@^3.27.1
  • @tiptap/extension-placeholder@^3.27.1
  • @tiptap/extension-table@^3.27.1
  • @tiptap/extension-task-item@^3.27.1
  • @tiptap/extension-task-list@^3.27.1
  • @tiptap/react@^3.27.1
  • @tiptap/starter-kit@^3.27.1
  • @types/bun@latest
  • @types/nodemailer@^8.0.1
  • @types/react@^19
  • @types/react-dom@^19
  • @types/turndown@^5.0.6
  • react@19.2.4
  • react-dom@19.2.4
  • tiptap-markdown@^0.9.0
  • typescript@^5.9.0

obfuscation 1

  • dynamic require()/import() joiha-steven-quireink-bfc4f88/scripts/build-admin.ts :58 const { PROSE_CSS } = await import(`${ROOT}src/web/prose.css.ts`)

perm:untrusted 1

  • untrusted joiha-steven-quireink-bfc4f88/v1/src/app/og/route.tsx :61 custom = await fetch(fontUrl).then((r) => (r.ok ? r.arrayBuffer() : null)).catch(() => null)