github TypeScript analyzed 8e9fd45

lanchuske/lanchu

Capa de control y confianza para coordinar múltiples agentes de IA. MCP, 100% local, open source.

Drift inferred · capture-to-capture

HIGH 2026-08-01 code analysis flagged dynamic code execution in lanchuske/lanchu

capabilities 0 tools

transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 8e9fd45 · analyzer v28 · 1d ago

dynamic code execution new Function() lanchuske-lanchu-8e9fd45/test/panel.test.mjs :52 assert.doesNotThrow(() => new Function(m[1]));

code evidence vv0.5.17 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 97

fs lanchuske-lanchu-8e9fd45/src/cli/completion.ts :12 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/cli/run.ts :2 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/config.ts :1 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/core/contract-sandbox-exec.ts :2 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/core/contract-sandbox.ts :1 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/core/mcps.ts :1 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/core/provenance.ts :11 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/core/runtimes.ts :2 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/core/skills_loader.ts :1 import fs from "node:fs/promises";
fs lanchuske-lanchu-8e9fd45/src/core/worktree.ts :2 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/db/db.ts :2 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/server/cockpit.ts :3 import fs from "node:fs";
fs lanchuske-lanchu-8e9fd45/src/server/server.ts :3 import fs from "node:fs";

shell lanchuske-lanchu-8e9fd45/src/cli/run.ts :1 import { spawn, spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/core/contract-sandbox-exec.ts :1 import { spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/core/git.ts :1 import { spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/core/provenance.ts :10 import { spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/core/runtimes.ts :1 import { spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/core/store.ts :1 import { spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/core/worktree.ts :1 import { spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/server/cockpit.ts :1 import { spawnSync } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/server/mcp.ts :1 import { spawn } from "node:child_process";
shell lanchuske-lanchu-8e9fd45/src/server/server.ts :1 import { spawn } from "node:child_process";

net lanchuske-lanchu-8e9fd45/src/cli/completion.ts :165 const res = await fetch(`${baseUrl()}${pathname}`, {
net lanchuske-lanchu-8e9fd45/src/cli/run.ts :88 /** fetch() against the backend (local or LANCHU_SERVER) with auth headers attached. */
net lanchuske-lanchu-8e9fd45/src/core/contract-sandbox-exec.ts :51 const http = require('http');
net lanchuske-lanchu-8e9fd45/src/core/mcps.ts :104 await fetch(s.target, { method: "HEAD", signal: AbortSignal.timeout(1500) });
net lanchuske-lanchu-8e9fd45/src/core/skills_loader.ts :27 res = await fetch(source, { headers: { accept: "text/markdown, text/plain, */*" } });
net lanchuske-lanchu-8e9fd45/src/server/intake.ts :103 fetch("/api/network/idea", {
net lanchuske-lanchu-8e9fd45/src/server/panel.ts :610 return fetch(url, authInit(init)).then(function (r) {
net lanchuske-lanchu-8e9fd45/src/server/profile.ts :85 fetch("/api/profile/" + encodeURIComponent(handle))
net lanchuske-lanchu-8e9fd45/src/server/server.ts :4 import http from "node:http";
net lanchuske-lanchu-8e9fd45/src/server/webhooks.ts :21 const r = await fetch(hook.url, { method: "POST", headers, body: bodyStr, signal: AbortSignal.timeout(5000) });

secrets lanchuske-lanchu-8e9fd45/src/config.ts :81 const k = process.env.LANCHU_ACCESS_KEY?.trim();
secrets lanchuske-lanchu-8e9fd45/src/server/server.ts :1438 const secret = process.env.LANCHU_INTAKE_SECRET;

prepublishOnly lanchuske-lanchu-8e9fd45/package.json :34 npm run clean && npm run build