MCP Observatory
6m ago Tracked 53,340 Last 6m ago 24h 2,739
github C# re-analysis due

okieselbach/AutopilotMonitor

github

Windows Autopilot & Intune enrollment monitoring: live session timelines, fleet health, diagnostics, and an MCP server for AI-assisted troubleshooting.

maintainer
okieselbach
license
AGPL-3.0
first seen
2026-09-03
last seen
2026-09-05
releases · 30d
60
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 48 tools
transport stdio · http counts 48 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • annotate_session
  • get_agent_efficiency_metrics
  • get_api_usage
  • get_app_install_metrics
  • get_audit_logs
  • get_device_history
  • get_fleet_overview
  • get_geographic_metrics
  • get_geographic_sessions
  • get_ime_pattern_health
  • get_ime_version_history
  • get_metrics
  • get_ops_events
  • get_platform_metrics
  • get_resource
  • get_rule_stats
  • get_session
  • get_session_diagnostics
  • get_session_events
  • get_session_summary
  • get_software_inventory
  • get_tenant_config
  • get_tenant_config_schema
  • get_time_attribution
  • get_usage_metrics
  • get_verdict_calibration
  • get_vulnerability_summary
  • list_blocked_devices
  • list_session_annotations
  • list_session_reports
  • list_tables
  • list_tenant_config_backups
  • list_tenants
  • query_backend_logs
  • query_raw_events
  • query_raw_sessions
  • query_table
  • revert_tenant_config
  • search_docs
  • search_events
  • search_knowledge
  • search_sessions
  • search_sessions_by_cve
  • search_sessions_by_event
  • test_analyze_rule
  • test_log_pattern
  • update_tenant_config
  • validate_rule
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 48fe68b · analyzer v33 · 2d ago

skills & prompt files 3

danger signals1

code evidence vv2.0.1446 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 2465

filesystem 19

  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/rules/scripts/combine.js :9 const fs = require('fs');
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/docs-corpus.test.ts :12 import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/event-types-drift.test.ts :14 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/hardcoded-urls.guard.test.ts :2 import { readdirSync, readFileSync, statSync } from 'node:fs';
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/rule-authoring-drift.test.ts :15 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/vocabulary-drift.guard.test.ts :20 import { readdirSync, readFileSync } from 'node:fs';
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/wire-types-freshness.test.ts :14 import { existsSync, readFileSync } from 'node:fs';
  • fs okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/docs-corpus.ts :22 import { readdir, readFile } from 'node:fs/promises';
  • fs okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/index.ts :2 import { readFileSync } from 'node:fs';
  • fs okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/knowledge-base.ts :9 import { readdir, readFile } from 'node:fs/promises';
  • fs okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/precompute-embeddings.ts :13 import { writeFileSync } from 'node:fs';
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/lib/__tests__/hostRouting.guard.test.ts :2 import { existsSync, readdirSync, readFileSync } from "node:fs";
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/scripts/generate-lastmod.js :10 const fs = require("fs");
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/scripts/generate-shared-manifest-types.js :26 const fs = require("fs");
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/scripts/generate-version.js :14 const fs = require("fs");
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/scripts/sync-error-codes.js :14 const fs = require("fs");
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/utils/__tests__/hardcodedUrls.guard.test.ts :2 import { readdirSync, readFileSync, statSync } from "node:fs";
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/utils/__tests__/sharedManifestParity.test.ts :9 import fs from "node:fs";
  • fs (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/utils/__tests__/swaConfig.guard.test.ts :2 import { readFileSync } from "node:fs";

shell / exec 2

  • shell (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/scripts/generate-lastmod.js :9 const { execSync } = require("child_process");
  • shell (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/scripts/generate-version.js :13 const { execSync } = require("child_process");

network 21

  • net (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/helpers.ts :49 const res = await fetch(url, { ...fetchOpts, headers, signal: AbortSignal.timeout(25_000) });
  • net (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/mcp-http.test.ts :21 import type { Server } from 'node:http';
  • net (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/oauth-cimd.test.ts :10 import type { Server } from 'node:http';
  • net (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/oauth-rate-limit.test.ts :16 import type { Server } from 'node:http';
  • net (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/oauth-register.test.ts :16 import type { Server } from 'node:http';
  • net (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/security-guards.test.ts :18 import type { AddressInfo } from 'node:net';
  • net okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/access-guard.ts :180 const res = await fetch(`${BASE_URL}/api/auth/mcp`, {
  • net okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/cimd.ts :31 import net from 'node:net';
  • net okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/client.ts :318 const res = await fetch(url, { ...options, headers, signal });
  • net okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/oauth.ts :888 const tokenResponse = await fetch(`${AUTHORITY}/oauth2/v2.0/token`, {
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/app/activation/page.tsx :125 const response = await fetch(api.preview.notificationEmail(), {
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/app/admin/metrics/sections/SectionAgentMetrics.tsx :146 // `days` query. Each picker change forces a fresh fetch (previous version
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/app/admin/ops/session-cleanup/components/RestoreBrowserTab.tsx :139 // Effect-scoped fetch (no useCallback) so each render captures the exact tenantId+refreshKey
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/app/dashboard/hooks/useBlockDevice.ts :34 // it wholesale on every fetch (and empties it while scope is off).
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/app/dashboard/hooks/useDashboardSessions.ts :103 * - initial fetch (gated on user role + tenantId/globalAdminMode readiness)
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/app/health-check/page.tsx :154 fetch("/version.json", { cache: "no-store" })
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/app/sessions/hooks/useSessionDetail.ts :55 * - initial fetch (gated on auth + tenantId readiness; resets on sessionId change)
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/components/landing/StatsBand.tsx :97 const manifestResponse = await fetch(PLATFORM_STATS_MANIFEST_URL, { cache: "no-store" });
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/contexts/AuthContext.tsx :117 const res = await fetch(api.auth.me(), {
  • net (weak) okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/lib/__tests__/dedupedAuthFetch.test.ts :47 // and reach its fetch() call. Both callers must already be hooked onto
  • net okieselbach-AutopilotMonitor-48fe68b/src/Web/autopilot-monitor-web/lib/authenticatedFetch.ts :42 const response = await fetch(url, { ...init, headers, signal });

secrets 5

  • secrets (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/helpers.ts :14 const TOKEN = process.env.AUTOPILOT_API_TOKEN ?? '';
  • secrets (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/tools-admin.test.ts :11 const RUN_INTEGRATION = !!process.env.AUTOPILOT_API_TOKEN;
  • secrets (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/tools-raw.test.ts :13 const RUN_INTEGRATION = !!process.env.AUTOPILOT_API_TOKEN;
  • secrets (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/tools-sessions.test.ts :15 const RUN_INTEGRATION = !!process.env.AUTOPILOT_API_TOKEN;
  • secrets okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/oauth.ts :42 const CLIENT_SECRET = process.env.AUTOPILOT_ENTRA_CLIENT_SECRET ?? '';

tool registrations 48

  • get_api_usage okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :329
  • get_geographic_metrics okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :377
  • get_geographic_sessions okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :416
  • get_platform_metrics okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :490
  • get_agent_efficiency_metrics okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :608
  • get_usage_metrics okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :648
  • get_fleet_overview okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :689
  • list_tenants okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :746
  • get_audit_logs okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :868
  • get_ops_events okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :919
  • get_verdict_calibration okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :986
  • list_session_reports okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1032
  • list_session_annotations okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1070
  • annotate_session okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1121
  • query_raw_events okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1162
  • query_raw_sessions okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1250
  • list_tables okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1330
  • query_table okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1349
  • query_backend_logs okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1414
  • get_tenant_config okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1449
  • get_tenant_config_schema okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1476
  • update_tenant_config okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1500
  • list_tenant_config_backups okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1541
  • revert_tenant_config okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1568
  • get_rule_stats okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1608
  • get_vulnerability_summary okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1664
  • get_app_install_metrics okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1705
  • get_time_attribution okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1751
  • get_device_history okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1802
  • get_software_inventory okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1877
  • get_resource okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts :1963
  • validate_rule okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/rules.ts :20
  • test_log_pattern okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/rules.ts :64
  • test_analyze_rule okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/rules.ts :102
  • search_events okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/search.ts :1040
  • search_knowledge okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/search.ts :1166
  • search_docs okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/search.ts :1270
  • search_sessions okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :97
  • search_sessions_by_event okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :217
  • get_session okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :265
  • get_session_diagnostics okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :307
  • get_session_events okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :404
  • get_session_summary okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :473
  • get_metrics okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :692
  • search_sessions_by_cve okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :745
  • list_blocked_devices okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :799
  • get_ime_pattern_health okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :831
  • get_ime_version_history okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts :861

declared dependencies 17

  • @modelcontextprotocol/node@^2.0.0
  • @modelcontextprotocol/server@^2.0.0
  • @modelcontextprotocol/client@^2.0.0
  • @huggingface/transformers@^3.8.1
  • ajv@^8.20.0
  • ajv-formats@^3.0.1
  • compression@^1.8.1
  • express@^5.2.1
  • fuse.js@^7.5.0
  • zod@^4.5.4
  • @types/compression@^1.8.1
  • @types/express@^5.0.6
  • @types/node@^22.20.1
  • tsx@^4.23.13
  • typescript@^5.0.0
  • vitest@^4.1.11
  • Newtonsoft.Json@13.0.3

perm:untrusted 1

  • untrusted (weak) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/__tests__/oauth-cimd.test.ts :61 const json = (await (await fetch(`${baseUrl}/.well-known/oauth-authorization-server`)).json()) as Record<string, unknown>;

transport_posture 1

  • binds all interfaces (0.0.0.0) okieselbach-AutopilotMonitor-48fe68b/src/McpServer/autopilot-monitor-mcp/src/index.ts :383 const server = app.listen(PORT, '0.0.0.0', () => {