Your assistant's home — the memory, keys, code, and automations your AI agent keeps, portable across every MCP host. Built on Cloudflare Workers.
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution ×4 in kentcdodds/kody
transport streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d02dcb5 · analyzer v28 · 2d ago
skills & prompt files 4
danger signals6
- dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/mcp/execute-modules/kody-runtime-utils.node.test.ts :499
const createSandboxHelpers = new Function( - dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/mcp/executor.node.test.ts :287
expect(() => new Function('__dispatchers', bundledFactorySource)({})).toThrow( - dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/mcp/run-kody-registry.node.test.ts :1151
const kody = new Function('__dispatchers', `${source}; return kody;`)( - dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/package-runtime/package-app.node.test.ts :54
return new Function('runtimeBridge', await extractCreateKodyProxySource())( - suspicious endpoint o123.ingest.us.sentry.io (telemetry)
expected for this server's purpose
kentcdodds-kody-d02dcb5/packages/worker/src/app/handlers/sentry-tunnel.node.test.ts :38
'https://o123.ingest.us.sentry.io/api/456/envelope/', - over-broad OAuth scope gmail.modify kentcdodds-kody-d02dcb5/packages/worker/src/integrations/service.node.test.ts :598
scopes: ['gmail.modify', 'gmail.readonly'],
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 1602
filesystem 19
- fs kentcdodds-kody-d02dcb5/packages/worker/src/og/og-image-assets.node.ts :1
import { readFileSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/build-client-manifest.ts :1
import { mkdir, readFile, writeFile } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/check-migrations.ts :3
import { readFile, readdir } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/ci/backfill-mcp-agent-sessions.ts :2
import { writeFile } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/ci/preview-resources.ts :1
import { readdirSync, statSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/ci/production-resources.ts :1
import { readFile } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/ci/resource-utils.ts :2
import { readFile, writeFile } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/ci/sync-worker-secrets.ts :2
import { readFile, unlink, writeFile } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/disaster-recovery/canonical-readiness-cli.ts :2
import { readFile, realpath } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/disaster-recovery/d1-restore-drill-cli.ts :3
import { createReadStream, createWriteStream } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/ensure-playwright-browser.ts :2
import { existsSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/evals/package-discovery-routing.ts :1
import { readFileSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/mcp-test-support.ts :3
import { mkdtemp, rm } from 'node:fs/promises' - fs kentcdodds-kody-d02dcb5/tools/node-runtime.ts :1
import { existsSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/prepare-e2e-env.ts :1
import { copyFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/seed-test-data.ts :1
import { existsSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/sentry-upload-sourcemaps.ts :1
import { existsSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/tools/vite-markdown-as-text.ts :1
import { readFileSync } from 'node:fs' - fs kentcdodds-kody-d02dcb5/wrangler-env.ts :2
import { existsSync } from 'node:fs'
shell / exec 12
- shell kentcdodds-kody-d02dcb5/cli.ts :1
import { spawn, type ChildProcess } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/packages/shared/src/password-hash.ts :103
if (normalizedHash.startsWith(`${passwordHashPrefix}$`)) { - shell kentcdodds-kody-d02dcb5/packages/worker/src/entitlements/errors.ts :44
`^Plan limit reached: your "([^"]+)" plan allows at most (\\d+) ${escapeRegex(label)} and you currently have (\\d+)\\. (.+)$`, - shell kentcdodds-kody-d02dcb5/tools/check-migrations.ts :2
import { execFile } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/tools/ci/resource-utils.ts :1
import { spawnSync } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/tools/ci/sync-worker-secrets.ts :1
import { spawn } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/tools/dev-process-utils.ts :1
import { spawn, type ChildProcess, type SpawnOptions } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/tools/disaster-recovery/d1-restore-drill-cli.ts :1
import { spawn } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/tools/ensure-playwright-browser.ts :1
import { spawnSync } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/tools/prepare-e2e-env.ts :24
`^\\s*(?:export\\s+)?${escapeForRegExp(key)}\\s*=\\s*(.*)$`, - shell kentcdodds-kody-d02dcb5/tools/sentry-upload-sourcemaps.ts :2
import { spawnSync } from 'node:child_process' - shell kentcdodds-kody-d02dcb5/wrangler-env.ts :1
import { type ChildProcess } from 'node:child_process'
network 84
- net kentcdodds-kody-d02dcb5/cli.ts :334
const response = await fetch(`${baseUrl}/__mocks/meta`) - net kentcdodds-kody-d02dcb5/packages/backup-control-plane/worker.ts :150
async fetch(request: Request, env: BackupEnvironment): Promise<Response> { - net kentcdodds-kody-d02dcb5/packages/mock-servers/cloudflare/src/mock-artifacts-do.ts :117
async fetch(request: Request): Promise<Response> { - net kentcdodds-kody-d02dcb5/packages/mock-servers/cloudflare/src/mock-email-messages-do.ts :56
async fetch(request: Request): Promise<Response> { - net kentcdodds-kody-d02dcb5/packages/mock-servers/cloudflare/src/worker.ts :1018
async fetch(request: Request, env: MockCloudflareEnv, ctx: ExecutionContext) { - net kentcdodds-kody-d02dcb5/packages/worker/client/client-router.tsx :657
const response = await fetch(details.action.toString(), init) - net kentcdodds-kody-d02dcb5/packages/worker/client/entry.tsx :72
const response = await fetch(src, { headers, signal }) - net kentcdodds-kody-d02dcb5/packages/worker/client/frame-prefetch.ts :32
const response = await fetch(src, { headers, signal }) - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-activity.tsx :200
const response = await fetch(buildActivityApiRequestUrl(href), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-approval-shared.ts :50
const response = await fetch(requestUrl, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-billing.tsx :209
const response = await fetch(billingApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-email.tsx :139
const response = await fetch(buildEmailApiRequestUrl(href), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-integrations.tsx :147
const response = await fetch(accountIntegrationsApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-jobs.tsx :135
const response = await fetch(buildJobsApiRequestUrl(href), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-mcp-servers.tsx :100
const response = await fetch(accountMcpServersApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-memories.tsx :106
const response = await fetch(buildMemoriesApiRequestUrl(url.href), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-package-invocation-tokens.tsx :177
const response = await fetch(accountPackageInvocationTokensApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-packages.tsx :106
const response = await fetch(buildPackagesApiRequestUrl(href), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-passkeys.tsx :64
const response = await fetch(passkeysApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-remote-connectors.tsx :101
const response = await fetch(accountRemoteConnectorsApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-secrets.tsx :401
const response = await fetch(`${requestUrl.pathname}${requestUrl.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-stars.tsx :40
const response = await fetch(accountStarsApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-two-factor.tsx :58
const response = await fetch(twoFactorApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-usage.tsx :69
const response = await fetch(usageApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account-values.tsx :134
const response = await fetch(buildValuesApiRequestUrl(href), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/account.tsx :94
fetch(`${accountProfileApiPath}${url.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-codemods.tsx :110
const response = await fetch(adminCodemodsApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-community-reports.tsx :68
const response = await fetch(`${adminCommunityReportsApiPath}${url.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-feature-flags.tsx :69
const response = await fetch(adminFeatureFlagsApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-insights.tsx :90
const response = await fetch(`${adminInsightsApiPath}${url.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-invites.tsx :57
const response = await fetch(`${adminInvitesApiPath}${url.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-platform-feedback.tsx :140
const response = await fetch(`${adminPlatformFeedbackApiPath}${url.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-roles.tsx :31
const response = await fetch(adminRolesApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-system-email.tsx :67
const response = await fetch(`${adminSystemEmailApiPath}${url.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/admin-users.tsx :147
const response = await fetch(buildAdminUsersApiRequestUrl(href), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/blog-post.tsx :58
const response = await fetch(routes.blogPostApi.href({ slug }), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/blog.tsx :31
const response = await fetch(blogApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/community-detail.tsx :90
const shellPromise = fetch(routes.communityDetailApi.href({ listingId }), { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/connect-oauth.tsx :353
const response = await fetch('/account/secrets.json', { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/email-verification-prompt.tsx :29
const response = await fetch(resendVerificationApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/login.tsx :191
const response = await fetch('/waiting-list', { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/oauth-authorize.tsx :63
const response = await fetch(`/oauth/authorize-info${url.search}`, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/onboarding-payload.ts :24
const response = await fetch(onboardingApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/onboarding-starter-card.tsx :83
const response = await fetch( - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/onboarding.tsx :62
const response = await fetch(onboardingApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/profile.tsx :67
const shellPromise = fetch( - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/reset-password.tsx :52
const response = await fetch('/password-reset', { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/timeline.tsx :40
const response = await fetch(timelineApiPath, { - net kentcdodds-kody-d02dcb5/packages/worker/client/routes/verify.tsx :57
const response = await fetch('/verify/2fa.json', { - net kentcdodds-kody-d02dcb5/packages/worker/client/session.ts :43
const response = await fetch('/session', { - net kentcdodds-kody-d02dcb5/packages/worker/client/social-sign-in.ts :24
const response = await fetch('/auth/providers.json', { - net kentcdodds-kody-d02dcb5/packages/worker/client/waitlist-banner.tsx :52
const response = await fetch('/waiting-list', { - net kentcdodds-kody-d02dcb5/packages/worker/src/app/client-preload-manifest.ts :55
const response = await assets.fetch(new Request(MANIFEST_ASSET_URL)) - net kentcdodds-kody-d02dcb5/packages/worker/src/app/email/cloudflare-email.ts :89
response = await fetch(endpoint.toString(), { - net kentcdodds-kody-d02dcb5/packages/worker/src/app/handler.ts :30
return await router.fetch(request) - net kentcdodds-kody-d02dcb5/packages/worker/src/app/handlers/account-secrets.ts :621
const response = await fetch(tokenUrl, { - net kentcdodds-kody-d02dcb5/packages/worker/src/app/handlers/auth-provider.ts :97
* The login and connections UIs start flows via fetch (Accept: json) and - net kentcdodds-kody-d02dcb5/packages/worker/src/app/handlers/package-app.ts :341
let entrypoint: { fetch(request: Request): Promise<Response> } - net kentcdodds-kody-d02dcb5/packages/worker/src/app/handlers/sentry-tunnel.ts :83
const upstream = await fetch(ingestUrl, { - net kentcdodds-kody-d02dcb5/packages/worker/src/app/inline-stylesheet.ts :44
const response = await assets.fetch(new Request(STYLESHEET_ASSET_URL)) - net kentcdodds-kody-d02dcb5/packages/worker/src/app/oauth-providers.ts :283
const response = await fetch(definition.tokenEndpoint, { - net kentcdodds-kody-d02dcb5/packages/worker/src/billing/stripe-client.ts :128
const response = await fetch(url.toString(), init) - net kentcdodds-kody-d02dcb5/packages/worker/src/index.ts :196
return stub.fetch(forwardRequest) - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/capabilities/coding/kody-official-guide.ts :109
response = await fetch(url, { - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/capabilities/integrations/integration-discover.ts :211
response = await fetch(url, { - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/capabilities/integrations/integration-registry-search.ts :72
response = await fetch(url, { - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/cloudflare/cloudflare-rest-client.ts :99
const response = await fetch(url.toString(), init) - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/execute-modules/kody-runtime-utils.ts :115
response = await fetch( - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/fetch-gateway.ts :66
async fetch(request: Request) { - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/instructions/execute-tool-description.ts :18
- \`fetch(...)\` is the host-provided network global; \`{{secret:name}}\` / \`{{secret:name|scope=user}}\` work in URL, headers, or body on approved hosts only. \`secretHeaders.basic(...)\` returns an - net kentcdodds-kody-d02dcb5/packages/worker/src/mcp/raw-fetch-host-nudge.ts :89
fetch(input: RequestInfo | URL, init?: RequestInit) { - net kentcdodds-kody-d02dcb5/packages/worker/src/oauth-handlers.ts :1023
async fetch(request: Request, _env: unknown, ctx: ExecutionContext) { - net kentcdodds-kody-d02dcb5/packages/worker/src/openapi/summarize-spec.ts :129
return 'Store a token secret and send Authorization: Bearer {{secret:<name>}} via execute fetch (gateway resolves placeholders and enforces the secret allowedHosts), or use a full integration + create - net kentcdodds-kody-d02dcb5/packages/worker/src/package-runtime/package-app.ts :477
throw new Error(\`Package Durable Object "\${exportName}" must implement fetch().\`); - net kentcdodds-kody-d02dcb5/packages/worker/src/package-runtime/package-service.ts :966
async fetch(request: Request) { - net kentcdodds-kody-d02dcb5/packages/worker/src/package-runtime/realtime-session.ts :725
async fetch(request: Request): Promise<Response> { - net kentcdodds-kody-d02dcb5/packages/worker/src/package-runtime/runtime-source-modules.ts :589
async fetch(request, env, ctx) { - net kentcdodds-kody-d02dcb5/packages/worker/src/remote-connector/session.ts :142
async fetch(request: Request): Promise<Response> { - net kentcdodds-kody-d02dcb5/packages/worker/src/repo/artifact-file.ts :79
await git.fetch({ - net kentcdodds-kody-d02dcb5/packages/worker/src/repo/publish-git-notes.ts :162
await git.fetch({ - net kentcdodds-kody-d02dcb5/packages/worker/src/repo/repo-session-do.ts :1427
return this.git.fetch({ - net kentcdodds-kody-d02dcb5/packages/worker/src/usage/aggregate-rollups.ts :299
const response = await fetch(url, { - net kentcdodds-kody-d02dcb5/tools/mcp-test-support.ts :294
const response = await fetch(`${origin}/__mocks/meta`, { - net kentcdodds-kody-d02dcb5/wrangler-env.ts :5
import net from 'node:net'
secrets 4
- secrets kentcdodds-kody-d02dcb5/tools/ci/backfill-mcp-agent-sessions-cli.ts :9
const apiToken = process.env['CLOUDFLARE_API_TOKEN'] - secrets kentcdodds-kody-d02dcb5/tools/ci/preview-resources.ts :365
if (!process.env.CLOUDFLARE_API_TOKEN && !options.dryRun) { - secrets kentcdodds-kody-d02dcb5/tools/ci/production-resources.ts :445
const apiToken = process.env.CLOUDFLARE_API_TOKEN?.trim() - secrets kentcdodds-kody-d02dcb5/tools/sentry-upload-sourcemaps.ts :15
const authToken = process.env.SENTRY_AUTH_TOKEN?.trim()
install hooks 1
- prepare kentcdodds-kody-d02dcb5/package.json :67
husky
declared dependencies 22
- @modelcontextprotocol/sdk@1.29.0
- @cloudflare/vitest-pool-workers@^0.17.0
- @cloudflare/workers-types@^4.20260702.1
- @epic-web/config@^1.24.1
- @kody-internal/shared@file:packages/shared
- @playwright/test@^1.58.2
- @sentry/cli@^3.3.3
- @types/node@^26.1.0
- concurrently@^9.2.1
- dotenv@^17.3.1
- esbuild@^0.27.4
- get-port@^7.1.0
- husky@^9.1.7
- lint-staged@^16.4.0
- msw@^2.14.6
- nx@^22.6.1
- oxfmt@^0.42.0
- oxlint@^1.55.0
- set-cookie-parser@^3.0.1
- typescript@^6.0.3
- vitest@^4.1.1
- wrangler@^4.107.0
clipboard 1
- clipboard shell call kentcdodds-kody-d02dcb5/cli.ts :509
const proc = spawn('pbcopy', [], { stdio: ['pipe', 'ignore', 'ignore'] })
cursor-plugin 1
- opaque (low) kentcdodds-kody-d02dcb5/.cursor/CLOUD.md
bundled .cursor/ plugin descriptor (kentcdodds-kody-d02dcb5/.cursor/CLOUD.md) — presence-detected; review the descriptor
obfuscation 2
- dynamic require()/import() kentcdodds-kody-d02dcb5/packages/worker/src/mcp/run-kody-registry.ts :1065
const __kodyModule = await import(${JSON.stringify(`./${bundle.mainModule}`)}); - dynamic require()/import() kentcdodds-kody-d02dcb5/packages/worker/src/package-runtime/package-app.ts :691
const userModule = await import(${JSON.stringify(`./${input.mainModule}`)});