github Python analyzed ff64e06

mocaOS/cortex-app

Institutional memory for the agentic era. Open-source GraphRAG knowledge base: documents in, Neo4j knowledge graph out. Humans get chat + deep research with cited answers, agents get a 100+ endpoint REST API, plug-in apps run right inside the instance. Self-host with one command: npx @mocaos/cortex

maintainer: mocaOS
licence: Apache-2.0
first seen: 2026-07-30
last seen: 2026-09-04
releases · 30d: 2
short id

Drift inferred · capture-to-capture

HIGH 2026-09-04 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-09-04 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-09-04 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-09-03 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-09-03 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-18 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-17 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-15 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-15 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-14 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-13 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-12 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-12 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-12 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-11 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-08-08 code analysis flagged committed secret in mocaOS/cortex-app
HIGH 2026-07-30 code analysis flagged committed secret in mocaOS/cortex-app

capabilities 0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit ff64e06 · analyzer v33 · 5d ago

skills & prompt files 5

danger signals6

suspicious endpoint 169.254.169.254 (cloud metadata) mocaOS-cortex-app-ff64e06/backend/tests/test_app_registry.py :133 "https://169.254.169.254/registry-app-1.0.0.zip"
suspicious endpoint 169.254.169.254 (cloud metadata) mocaOS-cortex-app-ff64e06/backend/tests/test_git_sync.py :285 "c1", "http://169.254.169.254/x.git", "main", "169.254.169.254", ""
suspicious endpoint 169.254.169.254 (cloud metadata) mocaOS-cortex-app-ff64e06/backend/tests/test_skill_http_ssrf.py :63 "http://169.254.169.254/latest/meta-data/", # cloud metadata (link-local)
suspicious endpoint 169.254.169.254 (cloud metadata) mocaOS-cortex-app-ff64e06/backend/tests/test_ssrf_guard.py :18 "http://169.254.169.254/latest/meta-data/", # cloud metadata
committed secret committed .env mocaOS-cortex-app-ff64e06/.env.recommended :1 env file shipped with populated values
committed secret Slack token mocaOS-cortex-app-ff64e06/handbook/16-integrations.md :401 xoxb-y…(21 chars, redacted)

code evidence vv1.2.1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 263

filesystem 38

fs mocaOS-cortex-app-ff64e06/backend/app/config.py :4 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/backend/app/main.py :9 import shutil
fs mocaOS-cortex-app-ff64e06/backend/app/metrics.py :122 import shutil
fs mocaOS-cortex-app-ff64e06/backend/app/services/anydoc_converter.py :39 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/backend/app/services/app_service.py :31 import shutil
fs mocaOS-cortex-app-ff64e06/backend/app/services/app_storage_service.py :27 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/backend/app/services/app_task_service.py :42 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/backend/app/services/audit_log.py :52 self._fh = open(path, "a", encoding="utf-8", buffering=1) # line-buffered
fs mocaOS-cortex-app-ff64e06/backend/app/services/crawl_client.py :153 "crawl4ai circuit is open (recent consecutive failures)"
fs mocaOS-cortex-app-ff64e06/backend/app/services/docling_worker.py :36 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/backend/app/services/document_processor.py :30 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/backend/app/services/git_connector_service.py :27 from pathlib import Path

show 26 more

fs mocaOS-cortex-app-ff64e06/backend/app/services/helper_client.py :24 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/backend/app/services/library_transfer_service.py :8 import shutil
fs mocaOS-cortex-app-ff64e06/backend/app/services/prompt_guard_client.py :168 Fails open (``(False, None)``) when the guard is off, unconfigured, or the
fs mocaOS-cortex-app-ff64e06/backend/app/services/skill_service.py :20 import shutil
fs mocaOS-cortex-app-ff64e06/backend/app/services/vision_analyzer.py :18 from pathlib import Path
fs (weak) mocaOS-cortex-app-ff64e06/backend/scripts/seed_langfuse_models.py :35 from pathlib import Path
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_audit_log.py :10 with open(path, encoding="utf-8") as f:
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_disk_guard.py :3 import shutil
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_git_sync.py :12 from pathlib import Path
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_import_chunked_upload.py :26 os.unlink(sess["path"])
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_library_transfer.py :21 from pathlib import Path
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_manifest_conformance.py :16 from pathlib import Path
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_no_content_documents.py :68 with open(path, "wb") as fh:
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_vision_image_prep.py :28 img = Image.open(io.BytesIO(base64.b64decode(b64)))
fs (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_web_import_task.py :107 with open(doc["file_path"], encoding="utf-8") as f:
fs mocaOS-cortex-app-ff64e06/bench/build_dashboard.py :20 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/bench/build_results_ods.py :16 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/bench/combo_resolver.py :23 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/bench/cortex_client.py :13 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/bench/llm_review.py :29 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/bench/qa_evaluator.py :36 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/bench/qa_snappiness.py :35 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/bench/run_bench.py :29 import shutil
fs mocaOS-cortex-app-ff64e06/bench/run_qa_bench.py :41 import shutil
fs mocaOS-cortex-app-ff64e06/bench/test_heuristics.py :12 from pathlib import Path
fs mocaOS-cortex-app-ff64e06/qa/gen_ods.py :30 data = json.load(open(src))

shell / exec 3

shell (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_git_sync.py :11 import subprocess
shell mocaOS-cortex-app-ff64e06/bench/log_parser.py :12 import subprocess
shell mocaOS-cortex-app-ff64e06/bench/run_bench.py :31 import subprocess

network 36

net mocaOS-cortex-app-ff64e06/backend/app/main.py :17 from urllib.parse import urlparse
net mocaOS-cortex-app-ff64e06/backend/app/services/app_registry_service.py :21 import httpx
net mocaOS-cortex-app-ff64e06/backend/app/services/app_service.py :772 from urllib.parse import unquote
net mocaOS-cortex-app-ff64e06/backend/app/services/app_task_dsl.py :75 from urllib.parse import quote
net mocaOS-cortex-app-ff64e06/backend/app/services/app_task_service.py :45 import httpx
net mocaOS-cortex-app-ff64e06/backend/app/services/crawl_client.py :32 import socket
net mocaOS-cortex-app-ff64e06/backend/app/services/git_providers/base.py :19 from urllib.parse import urlparse
net mocaOS-cortex-app-ff64e06/backend/app/services/git_providers/gitea.py :12 from urllib.parse import quote
net mocaOS-cortex-app-ff64e06/backend/app/services/git_providers/github.py :11 from urllib.parse import quote
net mocaOS-cortex-app-ff64e06/backend/app/services/git_providers/gitlab.py :14 from urllib.parse import quote
net mocaOS-cortex-app-ff64e06/backend/app/services/graph_extractor.py :58 httpx.ConnectError/ConnectTimeout), or a proxy's 502/503/504 while the
net mocaOS-cortex-app-ff64e06/backend/app/services/helper_client.py :21 import socket

show 24 more

net mocaOS-cortex-app-ff64e06/backend/app/services/observability.py :23 from urllib.parse import urlparse
net mocaOS-cortex-app-ff64e06/backend/app/services/prompt_guard_client.py :18 import socket
net mocaOS-cortex-app-ff64e06/backend/app/services/remote_mcp.py :34 import httpx
net mocaOS-cortex-app-ff64e06/backend/app/services/researcher_agent.py :26 import httpx
net mocaOS-cortex-app-ff64e06/backend/app/services/skill_service.py :27 import httpx
net mocaOS-cortex-app-ff64e06/backend/app/services/ssrf_guard.py :29 import socket
net mocaOS-cortex-app-ff64e06/backend/app/services/vision_analyzer.py :21 import httpx
net mocaOS-cortex-app-ff64e06/backend/app/services/webhook_service.py :39 import httpx
net mocaOS-cortex-app-ff64e06/backend/app/services/x402_service.py :39 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/scripts/seed_langfuse_models.py :33 import urllib.request
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/conftest.py :146 - httpx.AsyncClient.post (vision_analyzer)
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_app_registry.py :11 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_app_tasks.py :20 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_apps.py :435 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_ingestion_webhooks.py :11 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_live_e2e.py :19 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_live_e2e_authed.py :21 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_manifest_conformance.py :34 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_prompt_guard_client.py :87 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_resilience.py :8 import httpx
net (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_skill_http_ssrf.py :70 monkeypatch.setattr("app.services.skill_service.httpx.AsyncClient", _NetworkRaiser)
net mocaOS-cortex-app-ff64e06/bench/_llm_io.py :28 import httpx
net mocaOS-cortex-app-ff64e06/bench/cortex_client.py :16 import httpx
net mocaOS-cortex-app-ff64e06/bench/qa_snappiness.py :38 import httpx

secrets 2

secrets (weak) mocaOS-cortex-app-ff64e06/backend/scripts/seed_langfuse_models.py :95 ap.add_argument("--secret-key", default=os.environ.get("LANGFUSE_SECRET_KEY", ""))
secrets (weak) mocaOS-cortex-app-ff64e06/backend/tests/test_live_e2e_authed.py :25 KEY = os.environ.get("CORTEX_E2E_API_KEY", "")

database 1

db mocaOS-cortex-app-ff64e06/backend/app/services/app_storage_service.py :23 import sqlite3

transport_posture 1

binds all interfaces (0.0.0.0) mocaOS-cortex-app-ff64e06/backend/app/main.py :9400 uvicorn.run(app, host="0.0.0.0", port=8000)