github TypeScript analyzed 68f1758

pasichDev/todo-mcp

Shared TODO/backlog MCP server — claim tracking, web UI with QR/LAN access, and AES-256-GCM encrypted local storage

maintainer: pasichDev
licence: MIT
first seen: 2026-09-01
last seen: 2026-09-02
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 10 tools

transport stdio · http verified reported listed in the official MCP registry counts 10 tools · 0 res · 0 prompts permission surface via code analysis

tools

todo_add
todo_check_update
todo_claim
todo_complete
todo_delete
todo_edit
todo_history
todo_list
todo_release
todo_version

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 68f1758 · analyzer v33 · 3d ago

skills & prompt files 1

skill pasichDev-docket-68f1758/skills/docket/SKILL.md

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 151

filesystem 70

fs (weak) pasichDev-docket-68f1758/docs/assets/demo-seed.mjs :19 import { mkdir, rm, writeFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/backend.test.ts :2 import { mkdtemp, rm } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/backup.restore.test.ts :5 import { mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/backup.test.ts :3 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/backup.ts :2 import { mkdir, readFile, readdir, rename, rm, stat } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/config.test.ts :2 import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/config.ts :1 import { mkdir, readFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/crypto.test.ts :3 import { mkdtemp, rm } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/crypto.ts :2 import { chmod } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/daemon-upgrade.test.ts :4 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/data-dir.integration.test.ts :3 import { access, chmod, mkdir, mkdtemp, rm, stat } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/data-dir.test.ts :2 import { mkdtemp, rm } from "node:fs/promises";

show 28 more

fs pasichDev-docket-68f1758/src/data-dir.ts :2 import { mkdir as createDirectory, open, rm, stat } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/device.test.ts :3 import { mkdtemp, rm } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/device.ts :2 import { chmod, readFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/filelock.race.test.ts :4 import { mkdtemp, readFile, rm, utimes, writeFile } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/filelock.ts :3 import { link, open, readFile, rename, rm, stat, utimes } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/fs-atomic.test.ts :5 import { mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/fs-atomic.ts :2 import { open, rename, rm, type FileHandle } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/generation.ts :2 import { readFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/history-store.test.ts :2 import { mkdtemp, rm, stat } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/history-store.ts :1 import { readFile } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/hooks/install.ts :1 import { constants } from "node:fs";
fs pasichDev-docket-68f1758/src/index.ts :4 import { readFile } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/log.ts :1 import { appendFileSync, chmodSync } from "node:fs";
fs (weak) pasichDev-docket-68f1758/src/mcp-remote-mode.test.ts :3 import { mkdtemp, readdir, rm } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/mcp-startup.test.ts :3 import { mkdtemp, rm } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/peers.test.ts :2 import { mkdtemp, rm } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/peers.ts :2 import { readFile } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/registry.ts :2 import { readFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/remote/client.test.ts :2 import { mkdtemp, readdir, rm } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/remote/credentials.ts :2 import { readFile, rename, rm, writeFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/repository.test.ts :2 import { mkdtemp, rm } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/roundtrip.test.ts :2 import { mkdtemp, rm } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/seq.invariant.test.ts :2 import { mkdtemp, rm } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/server/admin-token.ts :2 import { readFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/server/auth.test.ts :3 import { mkdtemp, rm } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/server/devices.ts :2 import { readFile, rename, writeFile } from "node:fs/promises";
fs (weak) pasichDev-docket-68f1758/src/server/migration.e2e.test.ts :3 import { mkdtemp, readFile, readdir, rm } from "node:fs/promises";
fs pasichDev-docket-68f1758/src/server/migrations.ts :3 import { readFile } from "node:fs/promises";

30 more not shown — this panel samples each group; the count above is the real total.

shell / exec 19

shell (weak) pasichDev-docket-68f1758/docs/assets/demo-seed.mjs :18 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/backup.restore.test.ts :2 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/daemon-upgrade.test.ts :2 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/data-dir.integration.test.ts :2 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/device.test.ts :2 import { execFile } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/filelock.race.test.ts :2 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/fs-atomic.test.ts :2 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/hooks/hook.failopen.test.ts :2 import { spawn } from "node:child_process";
shell pasichDev-docket-68f1758/src/hooks/install.ts :273 const { spawn } = await import("node:child_process");
shell pasichDev-docket-68f1758/src/index.ts :3 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/mcp-remote-mode.test.ts :2 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/mcp-startup.test.ts :2 import { spawn } from "node:child_process";

show 7 more

shell (weak) pasichDev-docket-68f1758/src/server/migration.e2e.test.ts :2 import { spawn, type ChildProcess } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/server/serve.e2e.test.ts :2 import { spawn, type ChildProcess } from "node:child_process";
shell pasichDev-docket-68f1758/src/setup.ts :3 import { execFile, type ExecFileException } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/smoke.cli.test.ts :2 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/storage.race.test.ts :2 import { spawn } from "node:child_process";
shell pasichDev-docket-68f1758/src/update.ts :1 import { spawn } from "node:child_process";
shell (weak) pasichDev-docket-68f1758/src/viewers.test.ts :2 import { execFile } from "node:child_process";

network 48

net (weak) pasichDev-docket-68f1758/docs/assets/demo-seed.mjs :30 const running = await fetch(`http://127.0.0.1:${PORT}/api/version`, { signal: AbortSignal.timeout(500) })
net pasichDev-docket-68f1758/src/backend.ts :320 const res = await fetch(`http://127.0.0.1:${port}/api/version`, { signal: AbortSignal.timeout(800) });
net pasichDev-docket-68f1758/src/backup.ts :260 const res = await fetch(`http://127.0.0.1:${port}/api/version`, { signal: AbortSignal.timeout(500) });
net (weak) pasichDev-docket-68f1758/src/daemon-upgrade.test.ts :32 import { createServer } from "node:http";
net (weak) pasichDev-docket-68f1758/src/data-dir.integration.test.ts :4 import { createServer, type Server } from "node:http";
net (weak) pasichDev-docket-68f1758/src/hooks/hook.failopen.test.ts :4 import { createServer, type Server } from "node:http";
net pasichDev-docket-68f1758/src/hooks/session-start.ts :56 const res = await fetch(url, { signal: AbortSignal.timeout(HOOK_TIMEOUT_MS) });
net pasichDev-docket-68f1758/src/index.ts :110 const res = await fetch(`http://127.0.0.1:${port}/api/version`, { signal: AbortSignal.timeout(800) });
net pasichDev-docket-68f1758/src/remote/client.ts :157 res = await fetch(`${this.serverOrigin}${path}`, {
net pasichDev-docket-68f1758/src/remote/enrolment.ts :45 res = await fetch(`${serverUrl.replace(/\/$/, "")}/api/v1/info`, { signal: AbortSignal.timeout(8000) });
net pasichDev-docket-68f1758/src/remote/signed-fetch.ts :25 const res = await fetch(`${serverUrl.replace(/\/$/, "")}${path}`, {
net pasichDev-docket-68f1758/src/server/admin-token.ts :3 import type { IncomingMessage } from "node:http";

show 28 more

net (weak) pasichDev-docket-68f1758/src/server/auth.test.ts :2 import type { IncomingMessage } from "node:http";
net pasichDev-docket-68f1758/src/server/auth.ts :1 import type { IncomingMessage } from "node:http";
net pasichDev-docket-68f1758/src/server/devices-cli.ts :31 res = await fetch(`${adminBaseUrl()}${path}`, {
net pasichDev-docket-68f1758/src/server/events.ts :2 import type { ServerResponse } from "node:http";
net (weak) pasichDev-docket-68f1758/src/server/migration.e2e.test.ts :91 const res = await fetch(url, init);
net pasichDev-docket-68f1758/src/server/routes.ts :1 import type { IncomingMessage, ServerResponse } from "node:http";
net (weak) pasichDev-docket-68f1758/src/server/serve.e2e.test.ts :13 * handshake and the /api/v1 HTTP surface with real fetch() calls and a real
net pasichDev-docket-68f1758/src/server/server.ts :1 import { createServer, type Server } from "node:http";
net (weak) pasichDev-docket-68f1758/src/smoke.web.test.ts :4 import type { Server } from "node:http";
net pasichDev-docket-68f1758/src/status.ts :27 const res = await fetch(`http://127.0.0.1:${port}/api/version`, { signal: AbortSignal.timeout(800) });
net (weak) pasichDev-docket-68f1758/src/sync.pagination.test.ts :5 import { createServer, type Server } from "node:http";
net (weak) pasichDev-docket-68f1758/src/sync.resilience.test.ts :5 import { createServer, type Server } from "node:http";
net pasichDev-docket-68f1758/src/sync/client.ts :72 const res = await fetch(url, { signal: AbortSignal.timeout(8000) });
net pasichDev-docket-68f1758/src/update.ts :214 const res = await fetch(`http://127.0.0.1:${port}/api/version`, { signal: AbortSignal.timeout(1000) });
net (weak) pasichDev-docket-68f1758/src/web/api.routes.test.ts :4 import type { Server } from "node:http";
net pasichDev-docket-68f1758/src/web/api.ts :1 import type { IncomingMessage, ServerResponse } from "node:http";
net pasichDev-docket-68f1758/src/web/client-assets.ts :4 import type { ServerResponse } from "node:http";
net pasichDev-docket-68f1758/src/web/client/app/addform.ts :50 await fetch("/api/todos", {
net pasichDev-docket-68f1758/src/web/client/app/api.ts :88 const res = await fetch(path);
net pasichDev-docket-68f1758/src/web/client/app/devices.ts :86 fetch("/api/pair/incoming").then((r) => r.json()),
net pasichDev-docket-68f1758/src/web/client/app/history.ts :15 const res = await fetch(`/api/todos/${encodeURIComponent(details.dataset.historyUuid ?? "")}/history`);
net pasichDev-docket-68f1758/src/web/client/app/list.ts :14 const res = await fetch("/api/todos");
net pasichDev-docket-68f1758/src/web/client/app/main.ts :30 const res = await fetch(`/api/todos/${id}`, { method: "DELETE" });
net pasichDev-docket-68f1758/src/web/client/app/modals.ts :276 await fetch(`/api/todos/${id}`, {
net pasichDev-docket-68f1758/src/web/client/app/pairing-ui.ts :57 const res = await fetch("/api/import", {
net pasichDev-docket-68f1758/src/web/http.ts :1 import type { IncomingMessage, ServerResponse } from "node:http";
net pasichDev-docket-68f1758/src/web/routes/access.ts :2 import type { IncomingMessage, ServerResponse } from "node:http";
net pasichDev-docket-68f1758/src/web/routes/data.ts :1 import type { IncomingMessage, ServerResponse } from "node:http";

8 more not shown — this panel samples each group; the count above is the real total.

tool registrations 10

todo_add pasichDev-docket-68f1758/src/index.ts :336
todo_edit pasichDev-docket-68f1758/src/index.ts :380
todo_claim pasichDev-docket-68f1758/src/index.ts :414
todo_release pasichDev-docket-68f1758/src/index.ts :433
todo_list pasichDev-docket-68f1758/src/index.ts :448
todo_complete pasichDev-docket-68f1758/src/index.ts :502
todo_history pasichDev-docket-68f1758/src/index.ts :517
todo_version pasichDev-docket-68f1758/src/index.ts :534
todo_check_update pasichDev-docket-68f1758/src/index.ts :546
todo_delete pasichDev-docket-68f1758/src/index.ts :570

install hooks 1

prepublishOnly pasichDev-docket-68f1758/package.json :59 npm run build

declared dependencies 6

@modelcontextprotocol/sdk@^1.29.0
qrcode@^1.5.4
zod@^4.4.3
@types/node@^24.0.0
@types/qrcode@^1.5.6
typescript@^5.7.0

obfuscation 3

dynamic require()/import() pasichDev-docket-68f1758/src/device.test.ts :15 const device = await import(${JSON.stringify(deviceModule)});
dynamic require()/import() pasichDev-docket-68f1758/src/fs-atomic.test.ts :188 const { decryptFromBuffer } = await import(`${CRYPTO_MODULE}?first-run=${randomUUID()}`);
dynamic require()/import() pasichDev-docket-68f1758/src/viewers.test.ts :15 const viewers = await import(${JSON.stringify(viewersModule)});

perm:untrusted 1

untrusted pasichDev-docket-68f1758/src/web/views.ts :116 const s = await (await fetch(\`/api/access/status/\${body.requestId}\`)).json();

transport_posture 1

network-listening, binds all interfaces, no auth detected pasichDev-docket-68f1758/src/web/server.ts :285 server.listen(port, "0.0.0.0", () => {