github TypeScript analyzed 12619ac unconfirmed MCP

lukaisailovic/openislands

github

Local-first dashboards your AI agent builds and keeps maintaining, over data that never leaves your machine.

maintainer: lukaisailovic
license: MIT
first seen: 2026-06-23
last seen: 2026-07-21
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-08-01 code analysis flagged dynamic code execution in lukaisailovic/openislands

capabilities 0 tools

transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 12619ac · analyzer v28 · 1d ago

skills & prompt files 22

danger signals1

dynamic code execution constructor escape lukaisailovic-openislands-12619ac/packages/mcp-server/test/tool-surface.test.ts :367 const reachable = (() => { try { return this.constructor.constructor("return process")(); } catch { return null; } })();

code evidence vv0.5.3 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 241

filesystem 14

fs lukaisailovic-openislands-12619ac/packages/cli/src/index.ts :12 import { createReadStream, existsSync, readFileSync, statSync, writeFileSync, mkdirSync, cpSync, readdirSync, renameSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/compiler/src/connectors.ts :15 import { existsSync, mkdtempSync, statSync, writeFileSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/compiler/src/customSchema.ts :15 import { mkdtempSync, existsSync, statSync, writeFileSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/compiler/src/migrate.ts :13 import { existsSync, readdirSync, renameSync, rmdirSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/compiler/src/workspace.ts :13 import { existsSync, readFileSync, readdirSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/mcp-server/src/server.ts :15 import { mkdir, rename } from "node:fs/promises";
fs lukaisailovic-openislands-12619ac/packages/runtime/src/server/custom.ts :16 import { existsSync, statSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/runtime/src/server/editorRoutes.ts :12 import { realpathSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/runtime/src/server/editorStore.ts :16 import { mkdirSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/runtime/src/server/editorSync.ts :9 import { realpathSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/runtime/src/server/project.ts :1 import { existsSync, readFileSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/storage/src/confine.ts :18 import { realpathSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/storage/src/content.ts :16 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
fs lukaisailovic-openislands-12619ac/packages/storage/src/state.ts :12 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";

shell / exec 1

shell lukaisailovic-openislands-12619ac/packages/runtime/src/islands/editor/grouping.ts :36 return `^${source}$`;

network 11

net lukaisailovic-openislands-12619ac/packages/cli/src/index.ts :13 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
net lukaisailovic-openislands-12619ac/packages/cli/src/serve.ts :6 import type { IncomingMessage, ServerResponse } from "node:http";
net lukaisailovic-openislands-12619ac/packages/compiler/src/connectors.ts :313 const res = await fetch(auth.tokenUrl, {
net lukaisailovic-openislands-12619ac/packages/mcp-server/src/http.ts :10 import type { IncomingMessage, ServerResponse } from "node:http";
net lukaisailovic-openislands-12619ac/packages/runtime/src/client/useConnectors.ts :8 const res = await fetch(`/api/connectors?app=${encodeURIComponent(appId)}`);
net lukaisailovic-openislands-12619ac/packages/runtime/src/client/useIslandQuery.ts :50 const res = await fetch(queryUrl(appId, dataset, range, select), {
net lukaisailovic-openislands-12619ac/packages/runtime/src/components/SourceDialog.tsx :101 fetch(url, { headers: { accept: "application/json" } })
net lukaisailovic-openislands-12619ac/packages/runtime/src/islands/BoardKanban.tsx :108 res = await fetch(`/api/action?app=${encodeURIComponent(appId)}`, {
net lukaisailovic-openislands-12619ac/packages/runtime/src/islands/FormEntry.tsx :66 const res = await fetch(`/api/action?app=${encodeURIComponent(appId)}&action=${encodeURIComponent(action)}`, {
net lukaisailovic-openislands-12619ac/packages/runtime/src/islands/SourceDoc.tsx :126 fetch(url)
net lukaisailovic-openislands-12619ac/packages/runtime/src/islands/editor/api.ts :16 const response = await fetch(`/api/editor/tree?${q({ app: appId, dir })}`);

secrets 1

secrets lukaisailovic-openislands-12619ac/packages/cli/src/index.ts :138 const mcpToken = opts.mcpToken ?? process.env.OPENISLANDS_MCP_TOKEN ?? null;

install hooks 1

postinstall lukaisailovic-openislands-12619ac/apps/docs/package.json :16 fumadocs-mdx

declared dependencies 7

oxfmt@^0.54.0
oxlint@^1.69.0
tsdown@^0.22.2
tsx@^4.19.2
turbo@^2.3.3
typescript@^5.7.2
vitest@^3.0.5