An MCP-native agentic control plane that installs into your own Google Cloud project in one command. Serverless git over Firestore and GCS, post-quantum encryption at rest, and a signed, journalled audit trail behind every privileged action.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 57 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
add_observations
-
answer_message
-
append_journal
-
ask_agent
-
cancel_work_item
-
check_answer
-
complete_work_item
-
create_entities
-
create_relations
-
delete_entities
-
delete_observations
-
delete_relations
-
gcp_api
-
get_time
-
gh_branch
-
gh_commit
-
gh_diff
-
gh_fork
-
gh_list
-
gh_log
-
gh_pr
-
gh_read
-
gh_release
-
gh_repos
-
gh_tag
-
gh_whoami
-
git_archive
-
git_diff
-
git_grep
-
git_list
-
git_log
-
git_propose
-
git_propose_patch
-
git_push
-
git_read
-
list_files
-
list_my_messages
-
list_pending_confirm
-
list_work_items
-
log_history
-
open_nodes
-
post_work_item
-
put_file
-
read_file
-
read_graph
-
read_history
-
read_job_log
-
read_journal
-
refresh
-
run_command
-
run_roll
-
run_status
-
search_history
-
search_nodes
-
stage_privileged_job
-
whoami
-
write_file
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 064daee · analyzer v33 · 3d ago
danger signals1
- over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform
expected for this server's purpose
paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :128
body: JSON.stringify({ scope: ['https://www.googleapis.com/auth/cloud-platform'], lifetime: '300s' }) },
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 45
filesystem 5
- fs paracoding-ai-paracoding-oss-064daee/control-plane/blob-audit.mjs :36
import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from 'node:fs'; - fs paracoding-ai-paracoding-oss-064daee/control-plane/route-audit.mjs :20
import { readFileSync, writeFileSync, existsSync } from 'node:fs'; - fs paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :18
import * as fs from 'fs'; - fs paracoding-ai-paracoding-oss-064daee/control-plane/src/pcgit/05-adapter/src/firestore-gcs-fs.ts :37
* `else if (fs.rmdir.length > 1) target._rm = fs.rmdir.bind(fs)` -- a - fs paracoding-ai-paracoding-oss-064daee/control-plane/src/pcgit/09-mcp/src/ref-gate.ts :88
return fs.readFile(path, options);
shell / exec 1
- shell paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :5273
// ops-exec fast-shell: token that authenticates the control-plane -> on-box ops-exec (:8022).
network 3
- net paracoding-ai-paracoding-oss-064daee/control-plane/mcp2026/conformance.mjs :70
import http from 'node:http'; - net paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :90
const res: any = await fetch(url, init); - net paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :27
import * as nodeHttp from 'http';
secrets 1
- secrets paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :1442
const _macKey = process.env.APPROVAL_MAC_KEY || '';
tool registrations 58
- gh_whoami paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :246
- gh_repos paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :273
- gh_read paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :289
- gh_list paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :306
- gh_log paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :320
- gh_diff paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :338
- gh_commit paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :366
- gh_branch paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :444
- gh_fork paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :460
- gh_pr paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :473
- gh_tag paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :496
- gh_release paracoding-ai-paracoding-oss-064daee/control-plane/src/ghtools.ts :541
- git_read paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :694
- git_list paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :775
- git_log paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :779
- git_diff paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :783
- git_archive paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :801
- git_propose paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :856
- git_propose_patch paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :868
- git_push paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :876
- git_grep paracoding-ai-paracoding-oss-064daee/control-plane/src/gittools.ts :900
- whoami paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :1701
- list_work_items paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :1729
- read_journal paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :1809
- create_entities paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2148
- add_observations paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2165
- create_relations paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2174
- delete_entities paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2195
- delete_observations paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2212
- delete_relations paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2231
- read_graph paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2244
- search_nodes paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2275
- open_nodes paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2308
- append_journal paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2336
- post_work_item paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2344
- complete_work_item paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2353
- cancel_work_item paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2365
- stage_privileged_job paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2377
- list_pending_confirm paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2405
- run_command paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2413
- log_history paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2451
- search_history paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2471
- read_history paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2476
- write_file paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2548
- put_file paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2577
- read_file paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2594
- list_files paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2619
- refresh paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2652
- ask_agent paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2732
- list_my_messages paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2741
- answer_message paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2751
- check_answer paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2759
- get_time paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2769
- read_job_log paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2787
- gcp_api paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2790
- run_status paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2793
- run_roll paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2796
- whoami paracoding-ai-paracoding-oss-064daee/control-plane/src/index.ts :2908
declared dependencies 16
- @modelcontextprotocol/core@2.0.0
- @modelcontextprotocol/sdk@1.29.0
- @modelcontextprotocol/server@2.0.0
- @google-cloud/storage@^7.7.0
- @simplewebauthn/server@10.0.0
- express@5.2.1
- firebase-admin@14.2.0
- http-proxy@1.18.1
- uuid@14.0.1
- zod@4.4.3
- isomorphic-git@^1.40.0
- diff@^9.0.0
- @types/express@^5.0.6
- @types/uuid@^10.0.0
- @types/node@^20.12.7
- typescript@^7.0.2