MCP Observatory
8m ago Tracked 59,479 Last 8m ago 24h 2,575
github TypeScript re-analysis due deep scan · partial (259/7,162 files)

kontourai/station

github

Station — the agent workspace where work ships with receipts

maintainer
kontourai
licence
Apache-2.0
first seen
2026-09-05
last seen
2026-09-17
releases · 30d
10
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 64 tools
transport stdio · http counts 64 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • board_move
  • board_pin
  • board_read
  • board_unpin
  • check_plugin_updates
  • connect_ssh_environment
  • continue_task
  • create_agent
  • create_integration
  • create_provider
  • delegate_task
  • delete_agent
  • delete_conversation
  • delete_integration
  • disconnect_ssh_environment
  • get_achievements
  • get_agent
  • get_config
  • get_conversation_messages
  • get_integration
  • get_project
  • get_ssh_environment
  • get_station_docs_topic
  • get_task
  • get_task_events
  • get_usage
  • install_plugin
  • install_registry_integration
  • install_skill
  • interrupt_task
  • list_agents
  • list_conversations
  • list_delegated_tasks
  • list_delegation_environments
  • list_delegation_targets
  • list_integrations
  • list_models
  • list_plugins
  • list_project_layouts
  • list_projects
  • list_providers
  • list_registry_integrations
  • list_registry_skills
  • list_skills
  • list_station_docs_topics
  • migrate_knowledge
  • navigate_to
  • read_logs
  • read_monitoring_events
  • record_skill_outcome
  • reindex_knowledge
  • remove_plugin
  • remove_ssh_environment
  • respond_to_task_request
  • search_knowledge
  • search_station_docs
  • send_message
  • system_status
  • track_skill_run
  • uninstall_skill
  • update_agent
  • update_config
  • update_plugin
  • update_skill
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 8966b99 · analyzer v33 · 4h ago

skills & prompt files 16

danger signals7

code evidence vbeta-desktop · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 6137

filesystem 400

  • fs kontourai-station-8966b99/deploy/public-ingress/smoke.mjs :4 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/builder-delivery-viewer/server/__tests__/plugin-server.test.ts :2 import { mkdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/builder-delivery-viewer/server/plugin.mjs :9 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/enterprise-layout/src/__tests__/enterprise-modal-a11y.test.tsx :8 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/fieldwork-review/server/__tests__/plugin-server.test.ts :10 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/fieldwork-review/server/plugin.mjs :10 import { existsSync, constants as fsConstants, readFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/registry/signed-package/prepare.ts :17 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/registry/signed-package/verify.ts :13 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/shared-providers/providers/npm-registry.js :12 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/shared-providers/providers/oauth-auth.js :8 import { readFile } from 'node:fs/promises';
  • fs (weak) kontourai-station-8966b99/examples/shared-providers/src/providers/npm-registry.ts :13 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/shared-providers/src/providers/oauth-auth.ts :9 import { readFile } from 'node:fs/promises';
show 28 more
  • fs (weak) kontourai-station-8966b99/examples/survey-review-workbench/server/__tests__/plugin-server.test.ts :18 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/examples/survey-review-workbench/server/plugin.mjs :29 import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/ops/nightly/macos-build-identity.test.mjs :1 import { readFileSync } from 'node:fs';
  • fs kontourai-station-8966b99/ops/nightly/macos-build-only-artifact.mjs :2 import { mkdirSync, realpathSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/ops/nightly/macos-build-only-cleanup.test.mjs :12 } from 'node:fs';
  • fs kontourai-station-8966b99/ops/nightly/macos-embedded-signing.mjs :8 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/ops/nightly/macos-embedded-signing.test.mjs :8 } from 'node:fs';
  • fs kontourai-station-8966b99/ops/nightly/macos-source-stamp.mjs :1 import { writeFileSync } from 'node:fs';
  • fs kontourai-station-8966b99/ops/nightly/owned-source-checkout.mjs :8 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/ops/nightly/owned-source-checkout.test.mjs :11 } from 'node:fs';
  • fs kontourai-station-8966b99/ops/release/macos-notarized-artifacts.mjs :10 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/ops/release/macos-notarized-artifacts.test.mjs :7 } from 'node:fs';
  • fs kontourai-station-8966b99/ops/release/macos-signing-readiness.mjs :13 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/ops/release/macos-signing-readiness.test.mjs :9 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/basis-pane/src/__tests__/package-boundary.test.ts :1 import { readdir, readFile } from 'node:fs/promises';
  • fs (weak) kontourai-station-8966b99/packages/basis-pane/src/__tests__/session-inventory-mcp-app.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/basis-pane/src/__tests__/task-basis-collection-boundary.test.ts :1 import { readFile } from 'node:fs/promises';
  • fs (weak) kontourai-station-8966b99/packages/board-pane/src/__tests__/package-boundary.test.ts :1 import { readdirSync, readFileSync, statSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/esbuild.config.mjs :52 import { chmodSync, mkdirSync, readFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/active-local-station.test.ts :8 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/build-metadata.test.ts :2 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/bundle.test.ts :11 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/checkpoints-command.test.ts :25 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/cli.test.ts :1 import { mkdtempSync, readdirSync, rmSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/cloud-project-import-durability.test.ts :14 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/cloud-project-import.test.ts :9 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/cloud.test.ts :8 } from 'node:fs';
  • fs (weak) kontourai-station-8966b99/packages/cli/src/__tests__/config.test.ts :8 } from 'node:fs';

360 more not shown — this panel samples each group; the count above is the real total.

shell / exec 278

  • shell kontourai-station-8966b99/deploy/public-ingress/smoke.mjs :2 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/builder-delivery-viewer/server/__tests__/plugin-server.test.ts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/registry/signed-package/verify.ts :2 import { spawnSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/shared-providers/providers/agent-registry.js :4 import { execSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/shared-providers/providers/npm-registry.js :4 import { execSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/shared-providers/providers/oauth-auth.js :7 import { execSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/shared-providers/src/providers/agent-registry.ts :5 import { execSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/shared-providers/src/providers/npm-registry.ts :5 import { execSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/examples/shared-providers/src/providers/oauth-auth.ts :8 import { execSync } from 'node:child_process';
  • shell kontourai-station-8966b99/ops/nightly/macos-build-only-artifact.mjs :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/ops/nightly/macos-build-only-artifact.test.mjs :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/ops/nightly/macos-build-only-cleanup.test.mjs :1 import { execFileSync } from 'node:child_process';
show 28 more
  • shell kontourai-station-8966b99/ops/nightly/macos-embedded-signing.mjs :1 import { spawnSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/ops/nightly/macos-embedded-signing.test.mjs :1 import { execFileSync, spawnSync } from 'node:child_process';
  • shell kontourai-station-8966b99/ops/nightly/macos-signing-identity.mjs :3 import { execFileSync } from 'node:child_process';
  • shell kontourai-station-8966b99/ops/nightly/owned-source-checkout.mjs :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/ops/nightly/owned-source-checkout.test.mjs :1 import { execFileSync } from 'node:child_process';
  • shell kontourai-station-8966b99/ops/release/macos-notarized-artifacts.mjs :1 import { spawn as defaultSpawn } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/ops/release/macos-notarized-artifacts.test.mjs :1237 const { spawn } = require('node:child_process');
  • shell kontourai-station-8966b99/packages/cli/build-metadata.mjs :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/build-metadata.test.ts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/bundle.test.ts :1 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/checkpoints-command.test.ts :16 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/cloud-project-import-durability.test.ts :13 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/cloud-project-import.test.ts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/cloud.test.ts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/helpers/longrunning-fixture-child.abnormal-exit.test.ts :1 import { type ChildProcess, spawn } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/helpers/longrunning-fixture-child.ts :1 import { type ChildProcess, spawn } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/home-recovery-plan.test.ts :1 import childProcess from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/lifecycle.test.ts :1 import { spawn } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/open-browser.test.ts :9 ) as unknown as typeof import('node:child_process').spawn;
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/platform.test.ts :1 import { execSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/profile.test.ts :1 import { spawn } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/service-remedy.test.ts :1 import { spawnSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/service.integration.test.ts :1 import { spawnSync } from 'node:child_process';
  • shell (weak) kontourai-station-8966b99/packages/cli/src/__tests__/station-instance-reconciler.test.ts :1 import { spawnSync } from 'node:child_process';
  • shell kontourai-station-8966b99/packages/cli/src/commands/checkpoints.ts :23 import { execFile, spawn } from 'node:child_process';
  • shell kontourai-station-8966b99/packages/cli/src/commands/desktop-companion.ts :1 import { type ChildProcess, spawn, spawnSync } from 'node:child_process';
  • shell kontourai-station-8966b99/packages/cli/src/commands/lifecycle-doctor.ts :1 import { execSync } from 'node:child_process';
  • shell kontourai-station-8966b99/packages/cli/src/commands/lifecycle.ts :1 import { execFileSync, execSync, spawn, spawnSync } from 'node:child_process';

238 more not shown — this panel samples each group; the count above is the real total.

network 219

  • net kontourai-station-8966b99/deploy/public-ingress/smoke.mjs :5 import http from 'node:http';
  • net (weak) kontourai-station-8966b99/examples/builder-delivery-viewer/src/index.tsx :60 const response = await fetch(url);
  • net (weak) kontourai-station-8966b99/examples/elevenlabs-voice/plugin.mjs :61 const res = await fetch(
  • net (weak) kontourai-station-8966b99/examples/elevenlabs-voice/src/ElevenLabsSTTProvider.ts :56 const res = await fetch(
  • net (weak) kontourai-station-8966b99/examples/elevenlabs-voice/src/ElevenLabsTTSProvider.ts :51 const res = await fetch(
  • net (weak) kontourai-station-8966b99/examples/fieldwork-review/src/api.ts :23 const response = await fetch(url, init);
  • net (weak) kontourai-station-8966b99/examples/fieldwork-review/src/hooks.ts :147 void fetch(closeUrl, { method: 'POST', keepalive: true });
  • net (weak) kontourai-station-8966b99/examples/shared-providers/providers/ldap-directory.js :9 const r = await fetch(`${base}/api/agents`);
  • net (weak) kontourai-station-8966b99/examples/shared-providers/providers/ldap-user.js :19 const agentsRes = await fetch(`${base}/api/agents`);
  • net (weak) kontourai-station-8966b99/examples/shared-providers/src/providers/ldap-directory.ts :13 const r = await fetch(`${base}/api/agents`);
  • net (weak) kontourai-station-8966b99/examples/shared-providers/src/providers/ldap-user.ts :24 const agentsRes = await fetch(`${base}/api/agents`);
  • net (weak) kontourai-station-8966b99/examples/station-sessions-mcp/server.mjs :39 const res = await fetch(`${API_BASE}/orchestration/sessions`);
show 28 more
  • net (weak) kontourai-station-8966b99/examples/survey-review-workbench/src/index.tsx :62 const response = await fetch(url, init);
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/core-http.test.ts :2 import { createServer } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/delegate.test.ts :1 import { createServer } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/dev-http.test.ts :2 import { type IncomingMessage, request } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/dev-security.test.ts :3 import { createServer, request as nodeHttpRequest } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/dev-server.test.ts :1 import { createServer } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/environment.test.ts :3 import { createServer } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/helpers/http-test-helpers.ts :1 import type { IncomingMessage } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/install.test.ts :242 expect(printed).toContain('network.fetch (active)');
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/knowledge-index.test.ts :1 import { createServer } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/lifecycle.test.ts :19 import { request as nodeRequest } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/local-self-auth.test.ts :3 import { createServer, type Server } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/operate-shell.test.ts :21 import { createServer } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/setup-command.test.ts :3 import { createServer } from 'node:http';
  • net (weak) kontourai-station-8966b99/packages/cli/src/__tests__/surface-http.test.ts :2 import { createServer } from 'node:http';
  • net kontourai-station-8966b99/packages/cli/src/cli.ts :547 return await fetch(url, { ...init, signal: controller.signal });
  • net kontourai-station-8966b99/packages/cli/src/commands/active-local-station.ts :18 import { isIP } from 'node:net';
  • net kontourai-station-8966b99/packages/cli/src/commands/core.ts :113 * `skills` get/update/delete) while removing the duplicate `fetch()` call
  • net kontourai-station-8966b99/packages/cli/src/commands/dev-command.ts :13 import { createServer } from 'node:net';
  • net kontourai-station-8966b99/packages/cli/src/commands/environment.ts :796 const response = await fetch(
  • net kontourai-station-8966b99/packages/cli/src/commands/install-registry.ts :498 const response = await fetch(registryUrl, withRequestTimeout());
  • net kontourai-station-8966b99/packages/cli/src/commands/lifecycle-doctor.ts :125 const response = await fetch('http://127.0.0.1:11434/api/tags', {
  • net kontourai-station-8966b99/packages/cli/src/commands/lifecycle.ts :26 import { request as httpRequest } from 'node:http';
  • net kontourai-station-8966b99/packages/cli/src/commands/local-browser.ts :27 const response = await fetch(
  • net kontourai-station-8966b99/packages/cli/src/commands/operate/shell.ts :525 const response = await fetch(
  • net kontourai-station-8966b99/packages/cli/src/commands/session-client.ts :1010 * The same `AbortSignal` the caller passed to the `fetch()` that produced
  • net kontourai-station-8966b99/packages/cli/src/commands/tailscale-serve.ts :64 const response = await fetch(`${endpoint}/.well-known/station/v1`, {
  • net kontourai-station-8966b99/packages/cli/src/dev/http.ts :8 import { createServer, type Server, type ServerResponse } from 'node:http';

179 more not shown — this panel samples each group; the count above is the real total.

secrets 29

  • secrets (weak) kontourai-station-8966b99/examples/elevenlabs-voice/plugin.mjs :23 const apiKey = config.get('apiKey') || process.env.ELEVENLABS_API_KEY;
  • secrets (weak) kontourai-station-8966b99/packages/cli/src/__tests__/core-http.test.ts :1501 process.env.STATION_API_CREDENTIAL = credential;
  • secrets (weak) kontourai-station-8966b99/packages/cli/src/__tests__/local-self-auth.test.ts :205 delete process.env.STATION_API_CREDENTIAL;
  • secrets kontourai-station-8966b99/packages/cli/src/commands/core-api.ts :384 : process.env.STATION_API_CREDENTIAL ||
  • secrets kontourai-station-8966b99/packages/cli/src/commands/lifecycle.ts :1002 const internalApiToken=process.env.STATION_INTERNAL_API_TOKEN;
  • secrets kontourai-station-8966b99/packages/cli/src/commands/triage.ts :665 typeof process.env.STATION_API_CREDENTIAL === 'string' ||
  • secrets kontourai-station-8966b99/playwright.config.ts :13 browserSessionCredential: process.env.STATION_E2E_BROWSER_SESSION_CREDENTIAL,
  • secrets (weak) kontourai-station-8966b99/scripts/ios-testflight-delivery-policy.mjs :138 observeDeliveryAdmission({ repository, token: process.env.GITHUB_TOKEN })
  • secrets (weak) kontourai-station-8966b99/scripts/release-availability-driver.mjs :403 Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
  • secrets (weak) kontourai-station-8966b99/scripts/resolve-android-build-run.mjs :342 const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN;
  • secrets (weak) kontourai-station-8966b99/scripts/source-availability-driver.mjs :145 Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
  • secrets (weak) kontourai-station-8966b99/scripts/station-agent-smoke.mjs :23 if (process.env.STATION_CREDENTIAL) return process.env.STATION_CREDENTIAL;
show 17 more
  • secrets (weak) kontourai-station-8966b99/scripts/usability-feedback.mjs :444 apiKey: localMuse ? 'local-cli' : process.env.OPENAI_API_KEY,
  • secrets (weak) kontourai-station-8966b99/scripts/voice-realtime-nova-smoke.ts :16 (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY)
  • secrets (weak) kontourai-station-8966b99/scripts/voice-realtime-openai-smoke.ts :30 const direct = process.env.OPENAI_API_KEY?.trim();
  • secrets (weak) kontourai-station-8966b99/src-server/providers/__tests__/codex-adapter.test.ts :258 const originalOpenAiKey = process.env.OPENAI_API_KEY;
  • secrets kontourai-station-8966b99/src-server/runtime/routes/runtime-routes.ts :1451 uiBootstrapToken: process.env.STATION_UI_BOOTSTRAP_TOKEN,
  • secrets (weak) kontourai-station-8966b99/src-server/services/secrets/__tests__/fixtures/secret-binding-mcp-child.mjs :10 const configured = process.env.BINDING_FIXTURE_TOKEN === 'fixture-sentinel';
  • secrets (weak) kontourai-station-8966b99/src-server/services/terminal/__tests__/terminal-service.test.ts :81 const priorToken = process.env.STATION_INTERNAL_API_TOKEN;
  • secrets kontourai-station-8966b99/src-server/telemetry.ts :45 const telemetryApiKey = process.env.STATION_TELEMETRY_API_KEY;
  • secrets (weak) kontourai-station-8966b99/src-server/tools/__tests__/station-control-canonical-routing.test.ts :27 process.env.STATION_INTERNAL_API_TOKEN = 'controller-token';
  • secrets (weak) kontourai-station-8966b99/src-server/tools/__tests__/station-control-delegation.binding-regression.test.ts :62 process.env.STATION_INTERNAL_API_TOKEN = 'internal-test-token';
  • secrets (weak) kontourai-station-8966b99/src-server/tools/__tests__/station-control-delegation.test.ts :24 process.env.STATION_INTERNAL_API_TOKEN = 'internal-test-token';
  • secrets (weak) kontourai-station-8966b99/tests/connect-modal.spec.ts :55 process.env.STATION_E2E_HOST_CREDENTIAL ??
  • secrets (weak) kontourai-station-8966b99/tests/connect-reconnect-banner.spec.ts :21 const credential = process.env.STATION_E2E_HOST_CREDENTIAL;
  • secrets (weak) kontourai-station-8966b99/tests/container-self-host.spec.ts :3 const credential = process.env.STATION_CONTAINER_HOST_CREDENTIAL;
  • secrets (weak) kontourai-station-8966b99/tests/device-pairing-mobile.spec.ts :163 process.env.STATION_E2E_HOST_CREDENTIAL ||
  • secrets (weak) kontourai-station-8966b99/tests/helpers/device-class-context.ts :58 process.env.STATION_E2E_BROWSER_SESSION_CREDENTIAL,
  • secrets (weak) kontourai-station-8966b99/tests/paired-device-chat.spec.ts :192 process.env.STATION_E2E_HOST_CREDENTIAL,

tool registrations 64

  • list_agents kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :65
  • get_agent kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :71
  • create_agent kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :90
  • update_agent kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :122
  • delete_agent kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :152
  • list_conversations kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :164
  • get_conversation_messages kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :180
  • delete_conversation kontourai-station-8966b99/src-server/tools/station-control-agent-tools.ts :200
  • board_pin kontourai-station-8966b99/src-server/tools/station-control-board-tools.ts :115
  • board_unpin kontourai-station-8966b99/src-server/tools/station-control-board-tools.ts :163
  • board_move kontourai-station-8966b99/src-server/tools/station-control-board-tools.ts :183
  • board_read kontourai-station-8966b99/src-server/tools/station-control-board-tools.ts :209
show 28 more
  • list_skills kontourai-station-8966b99/src-server/tools/station-control-catalog-tools.ts :21
  • list_registry_skills kontourai-station-8966b99/src-server/tools/station-control-catalog-tools.ts :28
  • install_skill kontourai-station-8966b99/src-server/tools/station-control-catalog-tools.ts :39
  • uninstall_skill kontourai-station-8966b99/src-server/tools/station-control-catalog-tools.ts :60
  • update_skill kontourai-station-8966b99/src-server/tools/station-control-catalog-tools.ts :74
  • track_skill_run kontourai-station-8966b99/src-server/tools/station-control-catalog-tools.ts :125
  • record_skill_outcome kontourai-station-8966b99/src-server/tools/station-control-catalog-tools.ts :136
  • system_status kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :524
  • list_models kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :528
  • read_logs kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :532
  • read_monitoring_events kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :574
  • navigate_to kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :635
  • list_projects kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :652
  • get_project kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :660
  • list_project_layouts kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :672
  • send_message kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :684
  • list_delegation_environments kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :767
  • list_delegation_targets kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :774
  • get_ssh_environment kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :819
  • connect_ssh_environment kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :836
  • disconnect_ssh_environment kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :844
  • remove_ssh_environment kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :857
  • list_delegated_tasks kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :869
  • delegate_task kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :887
  • get_task kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :978
  • get_task_events kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :994
  • continue_task kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :1018
  • respond_to_task_request kontourai-station-8966b99/src-server/tools/station-control-operations-tools.ts :1042

24 more not shown — this panel samples each group; the count above is the real total.

install hooks 1

  • prepack kontourai-station-8966b99/packages/cli/package.json :19 node esbuild.config.mjs

declared dependencies 182

  • @modelcontextprotocol/client@^2.0.0
  • @modelcontextprotocol/ext-apps@^1.7.5
  • @modelcontextprotocol/sdk@^1.30.0
  • @modelcontextprotocol/server@^2.0.0
  • @agentclientprotocol/sdk@^1.4.0
  • @ai-sdk/amazon-bedrock@^4.0.141
  • @ai-sdk/anthropic@^3.0.102
  • @ai-sdk/google@^3.0.101
  • @ai-sdk/openai-compatible@^2.0.35
  • @ai-sdk/provider-utils@^4.0.50
  • @anthropic-ai/claude-agent-sdk@^0.3.261
  • @anthropic-ai/sdk@^0.122.0
show 28 more
  • @aws-sdk/client-bedrock@^3.1127.0
  • @aws-sdk/client-bedrock-runtime@^3.1127.0
  • @aws-sdk/client-pricing@^3.1127.0
  • @aws-sdk/client-s3@^3.1127.0
  • @aws-sdk/credential-providers@^3.1127.0
  • @hono/node-server@^2.1.1
  • @kontourai/bearing@^0.2.0
  • @kontourai/conduit@0.6.0
  • @kontourai/console-core@^0.3.0
  • @kontourai/console-server@^1.0.0
  • @kontourai/console-ui@^0.2.0
  • @kontourai/dispatch@0.5.0
  • @kontourai/ephemeris@0.4.1
  • @kontourai/ferry@0.6.0
  • @kontourai/fieldwork@0.10.0
  • @kontourai/flow@5.1.1
  • @kontourai/flow-agents@6.2.0
  • @kontourai/forage@^0.7.0
  • @kontourai/relay@0.6.0
  • @kontourai/station-basis-pane@^0.3.0
  • @kontourai/station-board-pane@0.1.2
  • @kontourai/station-connect@^0.5.1
  • @kontourai/station-contracts@^0.7.0
  • @kontourai/station-sdk@^0.7.0
  • @kontourai/station-shared@^0.7.0
  • @kontourai/surface@3.2.0
  • @kontourai/survey@3.0.0
  • @kontourai/thread@0.5.0

142 more not shown — this panel samples each group; the count above is the real total.

clipboard 1

  • navigator.clipboard kontourai-station-8966b99/src-ui/src/lib/clipboard.ts :34 const clipboard = navigator.clipboard;

obfuscation 5

  • dynamic require()/import() kontourai-station-8966b99/packages/shared/src/__tests__/node-http-compat.test.ts :37 const { runCli } = await import(${JSON.stringify(new URL('../../../cli/src/cli.ts', import.meta.url).href)});
  • dynamic require()/import() kontourai-station-8966b99/packages/shared/src/__tests__/station-home-recovery-preflight.test.ts :538 const { inspectStationHomeRecovery } = await import(${JSON.stringify(new URL('../station-home-recovery-preflight.ts', import.meta.url).href)});
  • dynamic require()/import() kontourai-station-8966b99/scripts/__tests__/public-contribution-surfaces.test.ts :60 const mod = await import(\`\${process.env.GITHUB_WORKSPACE}/${module}\`);
  • dynamic require()/import() kontourai-station-8966b99/scripts/__tests__/server-build-portability.test.ts :206 const { createIsolatedTaskSearch, sessionReadAuthorityFromRequest } = await import(pathToFileURL(${JSON.stringify(taskReaderProbe)}));
  • dynamic require()/import() kontourai-station-8966b99/src-server/routes/chat/__tests__/chat-turn-dedup.test.ts :79 const { ChatTurnDedupStore } = await import(${JSON.stringify(moduleUrl)});

perm:untrusted 3

  • untrusted (weak) kontourai-station-8966b99/src-server/services/__tests__/openssh-transport.integration.test.ts :112 fetch(`${base}/api/system/status`).then((value) => value.json()),
  • untrusted (weak) kontourai-station-8966b99/src-server/services/evidence/__tests__/console-bridge-service.test.ts :184 const state = (await (await fetch(`${hubUrl}/state`)).json()) as {
  • untrusted (weak) kontourai-station-8966b99/tests/status-token-contrast.spec.ts :534 const source = await (await fetch(entry)).text();

transport_posture 9

  • binds all interfaces (0.0.0.0) kontourai-station-8966b99/deploy/public-ingress/smoke.mjs :137 server.listen(3000, '0.0.0.0');
  • binds all interfaces (0.0.0.0) kontourai-station-8966b99/packages/cli/src/__tests__/lifecycle.test.ts :1680 host: '0.0.0.0',
  • network-listening, binds all interfaces, no auth detected kontourai-station-8966b99/packages/cli/src/__tests__/service.test.ts :704 host: '0.0.0.0',
  • binds all interfaces (0.0.0.0) kontourai-station-8966b99/packages/cli/src/commands/lifecycle.ts :1006 http.createServer(uiRequestHandler({http,crypto,fs,path,dir,mime,inject,upstreamPort,backendPrefixes,backendNavigationPrefixes,readinessFile,identity,internalApiToken,trustedTailscaleServeOrigin,hoste
  • network-listening, binds all interfaces, no auth detected kontourai-station-8966b99/scripts/__tests__/vite-loopback-default.test.ts :427 server.listen(0, '0.0.0.0', () => {
  • network-listening, binds all interfaces, no auth detected kontourai-station-8966b99/scripts/phone-ui-server.mjs :73 }).listen(port, '0.0.0.0', () => {
  • binds all interfaces (0.0.0.0) kontourai-station-8966b99/src-server/runtime/__tests__/pairing-approval-transport.test.ts :149 server.listen(0, '0.0.0.0');
  • network-listening, binds all interfaces, no auth detected kontourai-station-8966b99/src-server/runtime/__tests__/runtime-cold-start-custom-agent.test.ts :1072 host: '0.0.0.0',
  • network-listening, binds all interfaces, no auth detected kontourai-station-8966b99/src-server/runtime/bootstrap/__tests__/readiness-handshake.test.ts :47 host: '0.0.0.0',