github TypeScript re-analysis due

ni-c/opengist-mcp

MCP server for Opengist, the self-hosted pastebin powered by Git

Drift inferred · capture-to-capture

tool count over time

08-11 15:09 now

2026-08-11 0t

2026-08-25 14t

capabilities 14 tools

transport stdio · http verified reported listed in the official MCP registry counts 14 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit ed87577 · analyzer v33 · 1w ago

suspicious endpoint 169.254.169.254 (cloud metadata) ni-c-opengist-mcp-ed87577/test/hosts.test.ts :27 ['http://169.254.169.254/latest/meta-data/', 'link-local'],
suspicious endpoint 1.1.1.1 ni-c-opengist-mcp-ed87577/test/hosts.test.ts :59 'https://1.1.1.1/x',
suspicious endpoint 100.100.100.200 (cloud metadata) ni-c-opengist-mcp-ed87577/test/hosts.test.ts :84 ['http://100.100.100.200/latest/meta-data/', 'link-local'],
suspicious endpoint 192.0.0.192 ni-c-opengist-mcp-ed87577/test/hosts.test.ts :85 ['http://192.0.0.192/latest/', 'link-local'],

code evidence vv0.3.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 30

fs (weak) ni-c-opengist-mcp-ed87577/docs/.vitepress/config.ts :1 import { readFileSync } from 'node:fs';
fs (weak) ni-c-opengist-mcp-ed87577/scripts/gen-assets.mjs :31 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';

net ni-c-opengist-mcp-ed87577/src/api.ts :5 } from 'undici';
net ni-c-opengist-mcp-ed87577/src/hosts.ts :1 import { isIP } from 'node:net';

show 2 more