Full-stack TypeScript framework built for AI agents: typed server and client with no codegen, multi-runtime, multi-framework SSR, and zero-JS islands.
- capability exposure inferred + 35
- tool safety inferred + 17
- trust mitigators mixed − 11
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 6m ago · see ecosystem CVEs →
- C · 49 → C · 41
- D · 69 → C · 49
- D · 61 → D · 69
No known CVEs for this server.
- high dangerous code
dynamic exec: new Function() · credential logged in 1 file(s) · obfuscated payload: dynamic require()/import()
- medium toxic flow (lethal trifecta)
lethal trifecta reachable across this server's tool + source surface: private-data access + untrusted-content ingestion + network exfil (a leg is proven only in the analyzed source)
analyzed commit fba30c7 · analyzer v31 · 16h ago
skills & prompt files 8
- agent-rules nifrajs-nifra-fba30c7/AGENTS.md
- prompt-file nifrajs-nifra-fba30c7/packages/prompt/CHANGELOG.md
- prompt-file nifrajs-nifra-fba30c7/packages/prompt/LLM.md
- prompt-file nifrajs-nifra-fba30c7/packages/prompt/README.md
- skill nifrajs-nifra-fba30c7/packages/skills/skills/nifra-api/SKILL.md
- skill nifrajs-nifra-fba30c7/packages/skills/skills/nifra-verify/SKILL.md
- skill nifrajs-nifra-fba30c7/packages/skills/skills/nifra-web/SKILL.md
- skill nifrajs-nifra-fba30c7/packages/skills/skills/nifra/SKILL.md
danger signals7
- dynamic code execution new Function() nifrajs-nifra-fba30c7/packages/schema/test/edge.test.ts :29
new Function("return 1") - dynamic code execution new Function() nifrajs-nifra-fba30c7/packages/web/test/deferred.test.ts :131
const mapDeferred = new Function("window", `${MAP_DEFERRED_SOURCE}; return mapDeferred`)( - dynamic code execution new Function() nifrajs-nifra-fba30c7/packages/web/test/hydration-container.test.ts :91
return new Function("document", `${lookup}\nreturn root`)(document) as object | null - dynamic code execution new Function() nifrajs-nifra-fba30c7/packages/web/test/server-fn-stub.test.ts :107
expect(() => new Function(stub.replaceAll(/^export /gm, ""))).not.toThrow() - dynamic code execution new Function() nifrajs-nifra-fba30c7/packages/web/test/service-worker.test.ts :177
new Function("self", "caches", "Response", "Request", "URL", "fetch", sw)( - dynamic code execution new Function() nifrajs-nifra-fba30c7/site/islands/playground.client.ts :133
const factory = new Function("server", "t", code.value) as (s: unknown, t: unknown) => unknown - credential in logs credential in log nifrajs-nifra-fba30c7/packages/core/test/logger.test.ts :82
logger.error("e", { password: "p" })
[](https://mcpobservatory.com/servers/github:nifrajs/nifra/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of nifrajs.