Your assistant's home — the memory, keys, code, and automations your AI agent keeps, portable across every MCP host. Built on Cloudflare Workers.
- capability exposure inferred + 35
- recent drift inferred + 12
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 45s ago · see ecosystem CVEs →
- C · 44 → C · 56
- B · 32 → C · 44
No known CVEs for this server.
- high dangerous code
dynamic exec: new Function() · obfuscated payload: dynamic require()/import()
analyzed commit d02dcb5 · analyzer v28 · 1d ago
skills & prompt files 4
danger signals6
- dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/mcp/execute-modules/kody-runtime-utils.node.test.ts :499
const createSandboxHelpers = new Function( - dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/mcp/executor.node.test.ts :287
expect(() => new Function('__dispatchers', bundledFactorySource)({})).toThrow( - dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/mcp/run-kody-registry.node.test.ts :1151
const kody = new Function('__dispatchers', `${source}; return kody;`)( - dynamic code execution new Function() kentcdodds-kody-d02dcb5/packages/worker/src/package-runtime/package-app.node.test.ts :54
return new Function('runtimeBridge', await extractCreateKodyProxySource())( - suspicious endpoint o123.ingest.us.sentry.io (telemetry)
expected for this server's purpose
kentcdodds-kody-d02dcb5/packages/worker/src/app/handlers/sentry-tunnel.node.test.ts :38
'https://o123.ingest.us.sentry.io/api/456/envelope/', - over-broad OAuth scope gmail.modify kentcdodds-kody-d02dcb5/packages/worker/src/integrations/service.node.test.ts :598
scopes: ['gmail.modify', 'gmail.readonly'],
- recent drift +12 capability drift →
[](https://mcpobservatory.com/servers/github:kentcdodds/kody/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of kentcdodds.