Self-hosted PaaS for private infrastructure. Deploy 200+ services on any server in one click. GPU monitoring, AI model management, VRAM checker, and MCP built in. Coolify alternative. MIT licensed. Free forever.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 6fa3aa1 · analyzer v33 · 1w ago
danger signals1
- suspicious endpoint 46.224.229.44 kubeara-core-6fa3aa1/libs/common/src/compose-parser/compose-parser.util.spec.ts :348
expect(resolved.env.CORS_ALLOWED_ORIGINS).toBe("http://46.224.229.44:7935");
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 642
filesystem 18
- fs kubeara-core-6fa3aa1/apps/agent-app/src/executors/deploy-template.executor.ts :4
import * as fs from "fs/promises"; - fs kubeara-core-6fa3aa1/apps/agent-app/src/filesystem/filesystem.service.ts :2
import * as fs from "fs/promises"; - fs kubeara-core-6fa3aa1/apps/agent-app/src/main.ts :1
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/agent-app/src/proxy/traefik-proxy.service.ts :4
import { existsSync } from "fs"; - fs kubeara-core-6fa3aa1/apps/agent-app/src/server-resources/server-resources.service.ts :3
import { access } from "node:fs/promises"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/seeders/billing-cycles.seed.ts :2
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/seeders/plans.seed.ts :2
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/seeders/templates.seed.ts :11
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/src/main.ts :1
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/email/email.utils.ts :1
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/public/utils/zoho-ticket-template.util.ts :1
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/server-connections/utils/agent-deploy-bundle.util.ts :1
import * as fs from "fs";
show 6 more
- fs kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/server-connections/utils/local-file.util.ts :1
import * as fs from "node:fs/promises"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/src/templates/build-template-records.util.ts :15
import * as fs from "fs"; - fs kubeara-core-6fa3aa1/apps/control-panel-app/src/templates/template-validation/discover-template-compose-files.util.ts :1
import * as fs from "fs"; - fs (weak) kubeara-core-6fa3aa1/libs/common/src/image-data-uri/image-data-uri.util.spec.ts :1
import { mkdirSync, mkdtempSync, writeFileSync } from "fs"; - fs kubeara-core-6fa3aa1/libs/common/src/image-data-uri/image-data-uri.util.ts :1
import * as fs from "fs"; - fs (weak) kubeara-core-6fa3aa1/libs/common/src/template-variables/template-variables.util.spec.ts :1
import { readFileSync } from "fs";
shell / exec 7
- shell kubeara-core-6fa3aa1/apps/agent-app/src/container/container.service.ts :2
import { spawn } from "child_process"; - shell kubeara-core-6fa3aa1/apps/agent-app/src/container/interfaces/container-log-session.interface.ts :1
import type { ChildProcess } from "child_process"; - shell kubeara-core-6fa3aa1/apps/agent-app/src/executors/deploy-template.executor.ts :2
import { spawn, type ChildProcess } from "child_process"; - shell kubeara-core-6fa3aa1/apps/agent-app/src/proxy/traefik-proxy.service.ts :3
import { spawn } from "child_process"; - shell kubeara-core-6fa3aa1/apps/agent-app/src/resource-availability/resource-availability.service.ts :2
import { spawn } from "node:child_process"; - shell kubeara-core-6fa3aa1/apps/agent-app/src/server-resources/server-resources.service.ts :2
import { spawn } from "node:child_process"; - shell kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/server-connections/adapters/local-agent-host.adapter.ts :1
import { exec } from "node:child_process";
network 11
- net kubeara-core-6fa3aa1/apps/agent-app/src/resource-availability/resource-availability.service.ts :237
"const net=require('net')", - net kubeara-core-6fa3aa1/apps/agent-app/src/socket-client/agent-public-ip.util.ts :13
const response = await fetch(DETECT_URL, { - net kubeara-core-6fa3aa1/apps/control-panel-app/src/cron/cron.service.ts :4
import axios from "axios"; - net kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/mcp-oauth/services/mcp-oauth-cimd.service.ts :2
import axios from "axios"; - net kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/public/services/zoho-desk.service.ts :8
import axios from "axios"; - net kubeara-core-6fa3aa1/apps/control-panel-app/src/modules/server-connections/services/agent-socket-tunnel.service.ts :9
import * as net from "node:net"; - net kubeara-core-6fa3aa1/console-app/src/api/api-error.ts :1
import { AxiosError } from "axios"; - net kubeara-core-6fa3aa1/console-app/src/api/axios.ts :6
} from "axios"; - net kubeara-core-6fa3aa1/console-app/src/components/support/floating-chat-widget/support-api.ts :16
const response = await fetch(buildApiUrl("/public/support"), { - net kubeara-core-6fa3aa1/console-app/src/features/auth/api/index.ts :1
import { isAxiosError } from "axios"; - net kubeara-core-6fa3aa1/worker/install-scripts-worker.js :2
async fetch(request, env) {
install hooks 2
- prepare kubeara-core-6fa3aa1/console-app/package.json :16
husky - prepare kubeara-core-6fa3aa1/package.json :52
husky
declared dependencies 71
- @modelcontextprotocol/sdk@^1.29.0
- @getbrevo/brevo@^6.0.1
- @nestjs/common@^11.1.27
- @nestjs/config@^4.0.4
- @nestjs/core@^11.1.27
- @nestjs/jwt@^11.0.2
- @nestjs/mapped-types@*
- @nestjs/passport@^11.0.5
- @nestjs/platform-express@^11.1.27
- @nestjs/platform-socket.io@^11.1.27
- @nestjs/schedule@^6.1.3
- @nestjs/typeorm@^11.0.3
show 28 more
- @nestjs/websockets@^11.1.27
- axios@^1.18.1
- bcrypt@^6.0.0
- class-transformer@^0.5.1
- class-validator@^0.15.1
- cookie-parser@^1.4.7
- dayjs@^1.11.20
- dotenv@^17.4.2
- js-yaml@^4.1.1
- jsonwebtoken@^9.0.3
- passport@^0.7.0
- passport-jwt@^4.0.1
- pg@^8.20.0
- redis@^5.12.1
- reflect-metadata@^0.2.2
- rxjs@^7.8.2
- socket.io@^4.8.3
- socket.io-client@^4.8.3
- ssh2@^1.17.0
- stripe@^22.3.0
- typeorm@^1.0.0
- winston@^3.19.0
- winston-loki@^6.1.4
- zod@^4.4.3
- @commitlint/cli@^21.0.1
- @commitlint/config-conventional@^21.0.1
- @eslint/eslintrc@^3.2.0
- @eslint/js@^9.18.0
31 more not shown — this panel samples each group; the count above is the real total.
transport_posture 1
- network-listening, binds all interfaces, no auth detected kubeara-core-6fa3aa1/apps/agent-app/src/resource-availability/resource-availability.service.ts :242
"server.listen(port,'0.0.0.0')",