github TypeScript re-analysis due

kosli-dev/mcp-server

MCP server for the Kosli API - catalog-driven, works with Claude Code, Claude Desktop, and any MCP client.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit a64eb71 · analyzer v30 · 2w ago

code evidence vv0.4.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 18

fs (weak) kosli-dev-mcp-server-a64eb71/scripts/generate-catalog.ts :1 import { writeFileSync } from "node:fs";

net (weak) kosli-dev-mcp-server-a64eb71/scripts/generate-catalog.ts :84 const response = await fetch(OPENAPI_URL);
net kosli-dev-mcp-server-a64eb71/src/client/kosli-client.ts :154 const response = await this.fetch(url, init);

secrets kosli-dev-mcp-server-a64eb71/src/config.ts :4 const apiKey = process.env.KOSLI_API_TOKEN || process.env.KOSLI_API_KEY;
secrets (weak) kosli-dev-mcp-server-a64eb71/test/config.test.ts :16 delete process.env.KOSLI_API_TOKEN;

prepublishOnly kosli-dev-mcp-server-a64eb71/package.json :22 npm run build && npm test