MCP Observatory
2m ago Tracked 59,936 Last 2m ago 24h 2,437
github Go re-analysis due deep scan · partial (346/3,688 files)

mudler/LocalAI

github

LocalAI is the open-source AI engine. Run any model - LLMs, vision, voice, image, video - on any hardware. No GPU required.

maintainer
mudler
licence
MIT
first seen
2026-05-22
last seen
2026-09-18
releases · 30d
2
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1e5bf6f · analyzer v33 · 5d ago

skills & prompt files 5

danger signals5

code evidence vv4.9.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 2626

filesystem 6

  • fs (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/e2e/class-hygiene.spec.js :2 import { readFileSync, readdirSync, statSync } from 'node:fs'
  • fs (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/e2e/coverage-fixtures.js :13 import { mkdirSync, writeFileSync } from 'node:fs'
  • fs (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/e2e/v8-coverage.js :19 import { mkdirSync, writeFileSync, existsSync } from 'node:fs'
  • fs (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/scripts/inline-style-gate.mjs :22 import { readFileSync, writeFileSync, readdirSync, statSync, existsSync } from 'node:fs'
  • fs (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/scripts/translate-locales.mjs :31 import { readFileSync, writeFileSync, readdirSync, existsSync, mkdirSync } from 'node:fs'
  • fs (weak) mudler-LocalAI-1e5bf6f/scripts/changed-backends.js :1 import fs from "fs";

shell / exec 1

  • shell mudler-LocalAI-1e5bf6f/core/http/static/assets/highlightjs.js :133 }),!0),this.lastIndex=0}exec(e){this.matcherRe.lastIndex=this.lastIndex

network 24

  • net (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/e2e/traces-audio.spec.js :5 // renderer fetch()es the player src — and must degrade to a readable note
  • net (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/scripts/translate-locales.mjs :90 const res = await fetch('https://api.anthropic.com/v1/messages', {
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/components/Sidebar.jsx :94 fetch(apiUrl('/api/features')).then(r => r.json()).then(setFeatures).catch(() => {})
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/components/console/ConsoleLayout.jsx :76 fetch(apiUrl('/api/features'))
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/context/AuthContext.jsx :16 return fetch(apiUrl('/api/auth/status'))
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/hooks/useAudioPeaks.js :37 const response = await fetch(src)
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/hooks/useChat.js :51 const res = await fetch(apiUrl(API_CONFIG.endpoints.modelLoadStatus(modelID)), { signal })
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/hooks/useSpectrogram.js :45 const resp = await fetch(src)
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/Home.jsx :64 fetch(apiUrl('/api/features'))
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/Login.jsx :65 fetch(apiUrl('/api/auth/status'))
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/Middleware.jsx :80 fetch(apiUrl('/api/middleware/status')),
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/ModelEditor.jsx :338 const response = await fetch(apiUrl(`/models/edit/${encodeURIComponent(name)}`), {
show 12 more
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/Skills.jsx :96 const res = await fetch(url, { credentials: 'same-origin' })
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/ThreeDGen.jsx :114 const glbResp = await fetch(apiUrl(url))
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/Traces.jsx :117 // data:) but the peaks renderer fetch()es the src and the CSP's connect-src
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/pages/Usage.jsx :655 const usagePromise = fetch(apiUrl(`${userUsageURL}?period=${period}`))
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/utils/api.js :46 const response = await fetch(apiUrl(endpoint), {
  • net mudler-LocalAI-1e5bf6f/core/http/react-ui/src/utils/mcpClientStorage.js :15 // fetch() refuses non-http schemes anyway, but reject early so they
  • net mudler-LocalAI-1e5bf6f/core/http/static/chat.js :1270 response = await fetch(endpoint, {
  • net mudler-LocalAI-1e5bf6f/core/http/static/image.js :125 const response = await fetch("v1/images/generations", {
  • net mudler-LocalAI-1e5bf6f/core/http/static/sound.js :85 const response = await fetch('v1/sound-generation', {
  • net mudler-LocalAI-1e5bf6f/core/http/static/talk.js :337 const response = await fetch('v1/realtime/calls', {
  • net mudler-LocalAI-1e5bf6f/core/http/static/tts.js :92 const response = await fetch("tts", {
  • net mudler-LocalAI-1e5bf6f/core/http/static/video.js :140 const response = await fetch("video", {

secrets 2

  • secrets (weak) mudler-LocalAI-1e5bf6f/core/http/react-ui/scripts/translate-locales.mjs :55 const PROVIDER = providerArg || (process.env.ANTHROPIC_API_KEY && !process.env.OPENAI_API_KEY ? 'anthropic' : 'openai')
  • secrets (weak) mudler-LocalAI-1e5bf6f/scripts/changed-backends.js :25 const token = process.env.GITHUB_TOKEN;

declared dependencies 200

  • github.com/modelcontextprotocol/go-sdk@v1.5.0
  • autoprefixer@^10.4.0
  • postcss@^8.3.7
  • postcss-cli@^10.0.0
  • dario.cat/mergo@v1.0.2
  • fyne.io/fyne/v2@v2.7.3
  • github.com/Masterminds/sprig/v3@v3.3.0
  • github.com/alecthomas/kong@v1.15.0
  • github.com/anthropics/anthropic-sdk-go@v1.42.0
  • github.com/aws/aws-sdk-go-v2@v1.41.7
  • github.com/aws/aws-sdk-go-v2/config@v1.32.16
  • github.com/aws/aws-sdk-go-v2/credentials@v1.19.17
show 28 more
  • github.com/aws/aws-sdk-go-v2/service/s3@v1.99.1
  • github.com/charmbracelet/glamour@v1.0.0
  • github.com/containerd/containerd@v1.7.33
  • github.com/coreos/go-oidc/v3@v3.18.0
  • github.com/dhowden/tag@v0.0.0-20240417053706-3d75831295e8
  • github.com/ebitengine/purego@v0.10.0
  • github.com/emirpasic/gods/v2@v2.0.0-alpha
  • github.com/fsnotify/fsnotify@v1.10.1
  • github.com/go-audio/wav@v1.1.0
  • github.com/go-skynet/go-llama.cpp@v0.0.0-20240314183750-6a8041ef6b46
  • github.com/gofrs/flock@v0.13.0
  • github.com/google/go-containerregistry@v0.21.6
  • github.com/google/uuid@v1.6.0
  • github.com/gpustack/gguf-parser-go@v0.25.0
  • github.com/hpcloud/tail@v1.0.0
  • github.com/ipfs/go-log@v1.0.5
  • github.com/jaypipes/ghw@v0.24.0
  • github.com/joho/godotenv@v1.5.1
  • github.com/klauspost/cpuid/v2@v2.3.0
  • github.com/labstack/echo/v4@v4.15.1
  • github.com/libp2p/go-libp2p@v0.48.0
  • github.com/lithammer/fuzzysearch@v1.1.8
  • github.com/mholt/archiver/v3@v3.5.1
  • github.com/microcosm-cc/bluemonday@v1.0.27
  • github.com/mudler/cogito@v0.11.1-0.20260721122412-6eece18a6bb6
  • github.com/mudler/edgevpn@v0.34.0
  • github.com/mudler/go-processmanager@v0.1.2-0.20260823202314-dfa0ed852db6
  • github.com/mudler/memory@v0.0.0-20260406210934-424c1ecf2cf8

160 more not shown — this panel samples each group; the count above is the real total.

perm:untrusted 1

  • untrusted mudler-LocalAI-1e5bf6f/core/http/react-ui/src/components/Sidebar.jsx :94 fetch(apiUrl('/api/features')).then(r => r.json()).then(setFeatures).catch(() => {})