MCP Observatory
3m ago Tracked 26,562 Last 3m ago 24h 1,904
github Go analyzed 506d359 unconfirmed MCP

marmutapp/superbased-observer

github

Local-first cost & token tracking for Claude Code, Cursor, Codex & 23 more AI coding agents — proxy-accurate per-model spend, an MCP server your agent can query, and an opt-in team rollup. 100% local, no telemetry.

maintainer
marmutapp
license
NOASSERTION
first seen
2026-07-17
last seen
2026-07-21
releases · 30d
8
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×6 in marmutapp/superbased-observer
capabilities 0 tools
transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 506d359 · analyzer v28 · 3h ago

danger signals6

code evidence vv1.22.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 2474

filesystem 4

  • fs superbasedapp-observer-506d359/vscode/esbuild.mjs :13 import { readFileSync } from 'node:fs';
  • fs superbasedapp-observer-506d359/vscode/src/binary-internals.ts :10 import * as fs from 'node:fs/promises';
  • fs superbasedapp-observer-506d359/vscode/src/binary.ts :3 import * as fs from 'node:fs/promises';
  • fs superbasedapp-observer-506d359/vscode/src/daemon-internals.ts :11 import * as fs from 'node:fs/promises';

shell / exec 9

  • shell superbasedapp-observer-506d359/browser-extension/native-messaging-host/host.js :77 const { spawn } = require("child_process");
  • shell superbasedapp-observer-506d359/internal/browserhost/hostfiles/host.js :77 const { spawn } = require("child_process");
  • shell superbasedapp-observer-506d359/internal/intelligence/dashboard/webapp/dist/assets/HelpDrawer-CI2BDAua.js :153 • Policy template — value (quality floors + cost minimization, the default), frugal (budget-first), fast (latency-first), plan-exec (plan pinned flagship, execution downshifts), strict-privacy (local/
  • shell superbasedapp-observer-506d359/npm/observer/bin/observer.js :13 const { spawn } = require('child_process');
  • shell superbasedapp-observer-506d359/vscode/src/binary-internals.ts :14 import { execFile } from 'node:child_process';
  • shell superbasedapp-observer-506d359/vscode/src/commands/instructions.ts :11 import { execFile } from 'node:child_process';
  • shell superbasedapp-observer-506d359/vscode/src/daemon.ts :10 import { spawn, ChildProcess } from 'node:child_process';
  • shell superbasedapp-observer-506d359/web/dist/assets/HelpDrawer-CI2BDAua.js :153 • Policy template — value (quality floors + cost minimization, the default), frugal (budget-first), fast (latency-first), plan-exec (plan pinned flagship, execution downshifts), strict-privacy (local/
  • shell superbasedapp-observer-506d359/web/src/pages/settings/HealthSection.tsx :67 Graceful shutdown + self re-exec (~1s). One in-flight proxied request

network 24

  • net superbasedapp-observer-506d359/browser-extension/src/content-isolated.js :4 // page's fetch (separate JS realm), so it receives captured turns from the
  • net superbasedapp-observer-506d359/browser-extension/src/content-main.js :978 // for BOTH the top-frame window.fetch (realm = this window) AND — via the
  • net superbasedapp-observer-506d359/browser-extension/tools/capture-harness.js :628 // Log EVERY fetch (matched or not, same-origin or cross-origin) so the
  • net superbasedapp-observer-506d359/sdk/typescript/src/index.ts :298 const resp = await fetch(url, {
  • net superbasedapp-observer-506d359/vscode/src/binary-internals.ts :13 import * as https from 'node:https';
  • net superbasedapp-observer-506d359/web/src/components/CommandPalette.tsx :97 fetch(`/api/sessions?page=1&limit=${RECENT_LIMIT}`),
  • net superbasedapp-observer-506d359/web/src/components/LaunchDock.tsx :273 fetch(`/api/launch/${encodeURIComponent(token)}`, { method: "DELETE" }).catch(() => {
  • net superbasedapp-observer-506d359/web/src/components/MilestonesCard.tsx :106 fetch("/api/compression/timeseries?days=36500&bucket=day")
  • net superbasedapp-observer-506d359/web/src/components/ProcessesSection.tsx :750 // Lazy-load: only fetch (and trigger the daemon's correlation passes) once the
  • net superbasedapp-observer-506d359/web/src/components/TopBar.tsx :59 const res = await fetch(endpoint);
  • net superbasedapp-observer-506d359/web/src/components/workspace/WorkspaceGrid.tsx :60 fetch("/api/terminal/workspace-layout")
  • net superbasedapp-observer-506d359/web/src/lib/api.ts :61 const res = await fetch("/api/remote/whoami", {
  • net superbasedapp-observer-506d359/web/src/lib/projectPanel.ts :114 res = await fetch(path, { headers: { Accept: "application/json" } });
  • net superbasedapp-observer-506d359/web/src/lib/version.ts :70 fetch(NPM_LATEST_URL, { headers: { Accept: "application/json" } })
  • net superbasedapp-observer-506d359/web/src/pages/Compression.tsx :621 const res = await fetch(endpoint, {
  • net superbasedapp-observer-506d359/web/src/pages/Patterns.tsx :296 // card's Preview fires a preview-only fetch (no disk write) and
  • net superbasedapp-observer-506d359/web/src/pages/Privacy.tsx :190 const res = await fetch("/api/enrolment/last-payload");
  • net superbasedapp-observer-506d359/web/src/pages/Suggestions.tsx :206 await fetch("/api/suggestions/state", {
  • net superbasedapp-observer-506d359/web/src/pages/settings/AntigravityHelperCard.tsx :32 const res = await fetch(ENDPOINT, { method: "HEAD" });
  • net superbasedapp-observer-506d359/web/src/pages/settings/ConnectedToolsSection.tsx :254 const res = await fetch("/api/tools/launch", {
  • net superbasedapp-observer-506d359/web/src/pages/settings/EnrolmentSection.tsx :29 const res = await fetch("/api/enrolment/unenroll", { method: "POST" });
  • net superbasedapp-observer-506d359/web/src/pages/settings/SetupWizard.tsx :241 const res = await fetch(endpoint, {
  • net superbasedapp-observer-506d359/web/src/pages/settings/StructuredConfigSection.tsx :86 const res = await fetch(`/api/config/section/${spec.id}`, {
  • net superbasedapp-observer-506d359/web2/src/lib/api.ts :16 const res = await fetch(path, {

declared dependencies 99

  • adm-zip@^0.5.16
  • tar@^7.4.3
  • @types/adm-zip@^0.5.5
  • @types/node@^20.0.0
  • @types/tar@^6.1.13
  • @types/vscode@^1.90.0
  • @vscode/vsce@^3.0.0
  • esbuild@^0.24.0
  • eslint@^9.39.0
  • ovsx@^0.10.0
  • tsx@^4.19.0
  • typescript@^5.5.0
  • typescript-eslint@^8.65.0
  • github.com/BurntSushi/toml@v1.6.0
  • github.com/billgraziano/dpapi@v0.5.0
  • github.com/cilium/ebpf@v0.21.0
  • github.com/coder/websocket@v1.8.15
  • github.com/creack/pty@v1.1.24
  • github.com/crewjam/saml@v0.5.1
  • github.com/elimity-com/scim@v0.0.0-20260506142751-830e1caafcc3
  • github.com/fsnotify/fsnotify@v1.9.0
  • github.com/klauspost/compress@v1.18.0
  • github.com/oapi-codegen/runtime@v1.4.1
  • github.com/scim2/filter-parser/v2@v2.2.0
  • github.com/spf13/cobra@v1.10.2
  • github.com/tailscale/hujson@v0.0.0-20260302212456-ecc657c15afd
  • github.com/tetratelabs/wazero@v1.12.0
  • github.com/xuri/excelize/v2@v2.10.1
  • github.com/zalando/go-keyring@v0.2.8
  • go.opentelemetry.io/otel@v1.43.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0
  • go.opentelemetry.io/otel/sdk@v1.43.0
  • go.opentelemetry.io/otel/trace@v1.43.0
  • go.opentelemetry.io/proto/otlp@v1.10.0
  • golang.org/x/crypto@v0.51.0
  • golang.org/x/net@v0.55.0
  • golang.org/x/sync@v0.20.0
  • golang.org/x/sys@v0.47.0
  • golang.org/x/term@v0.45.0
  • google.golang.org/grpc@v1.80.0
  • google.golang.org/protobuf@v1.36.11
  • gopkg.in/yaml.v3@v3.0.1
  • modernc.org/sqlite@v1.48.2
  • github.com/apapsch/go-jsonmerge/v2@v2.0.0
  • github.com/beevik/etree@v1.6.0
  • github.com/cenkalti/backoff/v5@v5.0.3
  • github.com/cespare/xxhash/v2@v2.3.0
  • github.com/danieljoos/wincred@v1.2.3
  • github.com/di-wu/parser@v0.2.2
  • github.com/di-wu/xsd-datetime@v1.0.0
  • github.com/dprotaso/go-yit@v0.0.0-20220510233725-9ba8df137936
  • github.com/dustin/go-humanize@v1.0.1
  • github.com/getkin/kin-openapi@v0.135.0
  • github.com/go-logr/logr@v1.4.3
  • github.com/go-logr/stdr@v1.2.2
  • github.com/go-openapi/jsonpointer@v0.22.4
  • github.com/go-openapi/swag/jsonname@v0.25.4
  • github.com/godbus/dbus/v5@v5.2.2
  • github.com/golang-jwt/jwt/v4@v4.5.2
  • github.com/google/uuid@v1.6.0
  • github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0
  • github.com/inconshreveable/mousetrap@v1.1.0
  • github.com/jonboulle/clockwork@v0.5.0
  • github.com/josharian/intern@v1.0.0
  • github.com/mailru/easyjson@v0.9.1
  • github.com/mattermost/xml-roundtrip-validator@v0.1.0
  • github.com/mattn/go-isatty@v0.0.20
  • github.com/mohae/deepcopy@v0.0.0-20170929034955-c48cc78d4826
  • github.com/ncruces/go-strftime@v1.0.0
  • github.com/oapi-codegen/oapi-codegen/v2@v2.7.0
  • github.com/oasdiff/yaml@v0.0.9
  • github.com/oasdiff/yaml3@v0.0.9
  • github.com/perimeterx/marshmallow@v1.1.5
  • github.com/pkg/errors@v0.9.1
  • github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec
  • github.com/richardlehane/mscfb@v1.0.6
  • github.com/richardlehane/msoleps@v1.0.6
  • github.com/russellhaering/goxmldsig@v1.6.0
  • github.com/speakeasy-api/jsonpath@v0.6.3
  • github.com/speakeasy-api/openapi@v1.19.2
  • github.com/spf13/pflag@v1.0.9
  • github.com/tiendc/go-deepcopy@v1.7.2
  • github.com/vmware-labs/yaml-jsonpath@v0.3.2
  • github.com/woodsbury/decimal128@v1.4.0
  • github.com/xuri/efp@v0.0.1
  • github.com/xuri/nfp@v0.0.2-0.20250530014748-2ddeb826f9a9
  • go.opentelemetry.io/auto/sdk@v1.2.1
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.43.0
  • go.opentelemetry.io/otel/metric@v1.43.0
  • go.yaml.in/yaml/v3@v3.0.4
  • golang.org/x/mod@v0.35.0
  • golang.org/x/text@v0.37.0
  • golang.org/x/tools@v0.44.0
  • google.golang.org/genproto/googleapis/api@v0.0.0-20260401024825-9d38bb4040a9
  • google.golang.org/genproto/googleapis/rpc@v0.0.0-20260401024825-9d38bb4040a9
  • modernc.org/libc@v1.70.0
  • modernc.org/mathutil@v1.7.1
  • modernc.org/memory@v1.11.0
  • mvdan.cc/gofumpt@v0.10.0