The open-source AI agent control plane: MCP firewall, model gateway with budgets, human approvals, runtime observability, and audit trails
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 20 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
add_comment
-
ask_user
-
create_issue
-
create_pull_request
-
estimate_compliance
-
get_approval_status
-
get_execution_tool
-
get_issue_tool
-
get_pull_request
-
improve_compliance
-
permission_prompt
-
request_approval
-
resolve_sbom_upstreams
-
run_flow_tool
-
search
-
search_sessions_tool
-
send_note_tool
-
update_comment
-
update_issue_tool
-
update_pull_request
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit ce59a15 · analyzer v33 · 1h ago
skills & prompt files 1
- agent-rules preloop-preloop-ce59a15/AGENTS.md
danger signals24
- dynamic code execution eval()/exec() preloop-preloop-ce59a15/backend/preloop/services/dynamic_fastmcp.py :1165
exec(wrapper_code, namespace) - dynamic code execution eval()/exec() preloop-preloop-ce59a15/backend/tests/services/test_db_pool_hold_diagnostics.py :166
exec( - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/api/test_event_webhooks.py :370
json={"url": "https://169.254.169.254/latest/meta-data", "event_types": []}, - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/endpoints/test_ai_models.py :396
api_endpoint="http://169.254.169.254/latest/meta-data", - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/models/test_session_embedding_setting_crud.py :89
({"base_url": "https://169.254.169.254/latest"}, "invalid_base_url"), - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/services/event_webhooks/test_targets.py :26
("https://169.254.169.254/latest/meta-data", "link-local"), - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/services/test_ai_model_provider.py :1703
"http://169.254.169.254/latest/meta-data", - suspicious endpoint 1.2.3.4 preloop-preloop-ce59a15/backend/tests/services/test_ai_model_provider.py :1756
"https://1.2.3.4/v1", - suspicious endpoint otlp.datadoghq.com (telemetry) preloop-preloop-ce59a15/backend/tests/services/test_otel_export.py :233
"https://otlp.datadoghq.com/v1/traces", "http/protobuf", "traces" - over-broad OAuth scope admin:org preloop-preloop-ce59a15/backend/preloop/sync/trackers/github.py :571
for scope in ["admin:org_hook", "admin:org", "write:org_hook"] - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/agents/test_agent_openhands.py :321
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/agents/test_container.py :1208
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/cra/test_persist.py :408
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/endpoints/test_runners_helpers.py :352
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/models/crud/test_flow_execution_log_scrubbing.py :16
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_flow_execution_logger.py :452
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_flow_orchestrator_git_credentials.py :18
github…(57 chars, redacted) - committed secret GitLab token preloop-preloop-ce59a15/backend/tests/services/test_follow_up_filing.py :48
glpat-…(26 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_log_persistence_backpressure.py :148
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_tracker_git_token.py :20
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/utils/test_git_credentials.py :30
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/utils/test_secret_scrubbing.py :18
github…(57 chars, redacted) - committed secret Anthropic key preloop-preloop-ce59a15/backend/tests/utils/test_secret_scrubbing.py :99
sk-ant…(39 chars, redacted) - committed secret Google API key preloop-preloop-ce59a15/backend/tests/utils/test_secret_scrubbing.py :232
AIzaSy…(39 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 2398
filesystem 196
- fs preloop-preloop-ce59a15/backend/preloop/__init__.py :5
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/a2a/delegation.py :27
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/agents/checkpoint_client.py :20
from pathlib import Path, PurePosixPath - fs preloop-preloop-ce59a15/backend/preloop/agents/cli_session.py :255
with tarfile.open( - fs preloop-preloop-ce59a15/backend/preloop/agents/codex.py :329
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/agents/completion_nudge.py :184
d = json.load(open(sys.argv[1])) - fs preloop-preloop-ce59a15/backend/preloop/agents/container.py :201
fd = os.open(path, os.O_RDONLY | os.O_NONBLOCK) - fs preloop-preloop-ce59a15/backend/preloop/agents/session_manifest.py :17
from pathlib import Path, PurePosixPath - fs preloop-preloop-ce59a15/backend/preloop/agents/stream_recovery.py :24
with path.open('rb') as stream: - fs preloop-preloop-ce59a15/backend/preloop/agents/verification.py :110
with open(os.path.join(verdict_dir, "verdict"), "w", encoding="utf-8") as fh: - fs preloop-preloop-ce59a15/backend/preloop/api/app.py :12
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/api/common.py :278
with open(config_path, "r") as f:
show 28 more
- fs preloop-preloop-ce59a15/backend/preloop/api/endpoints/oauth_consent.py :16
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/api/ssr.py :3
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/config.py :6
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/cra/ci.py :24
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/cra/evidence_pack.py :123
with tarfile.open(fileobj=io.BytesIO(archive), mode="r:gz") as tar: - fs preloop-preloop-ce59a15/backend/preloop/flow_presets.py :32
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/integrations/agent_control/adapters.py :13
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/models/db/pool_diagnostics.py :12
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/models/migrate.py :20
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/security/git_guard.py :19
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/alibaba_pricing.py :19
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/avatar.py :82
img = Image.open(io.BytesIO(data)) - fs preloop-preloop-ce59a15/backend/preloop/services/cache_accounting.py :29
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/checkpoint_runtime.py :5
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/context_analysis.py :17
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/example_optimization.py :34
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/flow_artifacts.py :10
from pathlib import PurePosixPath - fs preloop-preloop-ce59a15/backend/preloop/services/flow_environment.py :6
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/model_price_catalog.py :35
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/multi_repo_publication.py :145
with tarfile.open(fileobj=io.BytesIO(archive), mode="r:gz") as tar: - fs preloop-preloop-ce59a15/backend/preloop/services/policy/loader.py :380
with open(file_path, "r", encoding="utf-8") as f: - fs preloop-preloop-ce59a15/backend/preloop/services/publication_hosted_verifier.py :77
with tarfile.open(fileobj=buffer, mode="w") as archive: - fs preloop-preloop-ce59a15/backend/preloop/services/publication_worker.py :19
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/services/push_notifications/apns_service.py :68
with open(auth_key_path, "r") as f: - fs preloop-preloop-ce59a15/backend/preloop/services/push_notifications/fcm_service.py :298
with open(creds_path, "r", encoding="utf-8") as handle: - fs preloop-preloop-ce59a15/backend/preloop/services/retention_export.py :419
with tarfile.open(fileobj=buffer, mode="w:gz") as tar: - fs preloop-preloop-ce59a15/backend/preloop/services/trusted_publisher.py :20
from pathlib import Path - fs preloop-preloop-ce59a15/backend/preloop/sync/config.py :7
from pathlib import Path
156 more not shown — this panel samples each group; the count above is the real total.
shell / exec 62
- shell preloop-preloop-ce59a15/backend/preloop/agents/checkpoint_client.py :15
import subprocess - shell preloop-preloop-ce59a15/backend/preloop/agents/session_runtime.py :16
import subprocess - shell preloop-preloop-ce59a15/backend/preloop/agents/verification.py :71
import subprocess - shell preloop-preloop-ce59a15/backend/preloop/models/db/setup.py :5
import subprocess - shell preloop-preloop-ce59a15/backend/preloop/security/git_guard.py :18
import subprocess - shell preloop-preloop-ce59a15/backend/preloop/services/flow_environment.py :139
p=subprocess.Popen(['bash','-e','-c',script],cwd=str(root),stdout=log,stderr=subprocess.STDOUT,start_new_session=True) - shell preloop-preloop-ce59a15/backend/preloop/services/publication_hosted_verifier.py :33
subprocess.run(git + args, env=env, check=True) - shell preloop-preloop-ce59a15/backend/preloop/services/trusted_publisher.py :14
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_agent_container.py :929
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_agent_opencode.py :857
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_codex_parent_session_recovery.py :9
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_completion_nudge.py :13
import subprocess
show 28 more
- shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_container.py :5
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_native_session_images.py :10
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_native_wrapper_ordering.py :45
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_opencode_protocol_routing.py :6
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_opencode_wrapper_config.py :5
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_prompt_stdin_delivery.py :18
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_report_publication_shell.py :19
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_stream_recovery.py :8
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_unpublished_workspace_recovery.py :4
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_verification_gate_shell.py :15
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/agents/test_workspace_snapshot.py :12
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/api/test_gateway_import_footprint.py :11
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/helm/chart_helpers.py :11
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/integration/helpers.py :6
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/integration/test_codex_mcp_canary.py :48
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/models/test_migration_upgrade_smoke.py :18
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/scripts/test_oss_install_env_escape.py :12
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/scripts/test_release_assets.py :7
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_evidence_transport.py :8
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_flow_artifacts.py :97
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_flow_environment.py :4
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_flow_pr_loop.py :11
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_isolated_publication.py :289
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_issue_lifecycle.py :1254
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_multi_repo_publication.py :8
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_publication_worker.py :5
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_report_publication.py :13
import subprocess - shell (weak) preloop-preloop-ce59a15/backend/tests/services/test_reviewed_model_price_refresh.py :775
import subprocess
22 more not shown — this panel samples each group; the count above is the real total.
network 164
- net preloop-preloop-ce59a15/backend/preloop/agents/checkpoint_client.py :19
import urllib.request - net preloop-preloop-ce59a15/backend/preloop/agents/container.py :4603
from urllib.parse import quote, urlparse - net preloop-preloop-ce59a15/backend/preloop/agents/gemini.py :8
from urllib.parse import urlsplit, urlunsplit - net preloop-preloop-ce59a15/backend/preloop/agents/session_runtime.py :18
import urllib.error - net preloop-preloop-ce59a15/backend/preloop/api/app.py :15
from urllib.parse import quote - net preloop-preloop-ce59a15/backend/preloop/api/endpoints/issues.py :1089
from urllib.parse import unquote - net preloop-preloop-ce59a15/backend/preloop/api/endpoints/mcp.py :27
from urllib.parse import urlparse, urlunparse - net preloop-preloop-ce59a15/backend/preloop/api/endpoints/mcp_servers.py :11
import httpx - net preloop-preloop-ce59a15/backend/preloop/api/endpoints/oauth_consent.py :23
from urllib.parse import urlencode - net preloop-preloop-ce59a15/backend/preloop/api/endpoints/oauth_server.py :18
from urllib.parse import urlencode - net preloop-preloop-ce59a15/backend/preloop/api/endpoints/pull_requests.py :14
import httpx - net preloop-preloop-ce59a15/backend/preloop/api/endpoints/runners.py :8
import socket
show 28 more
- net preloop-preloop-ce59a15/backend/preloop/api/endpoints/version.py :5
from urllib.parse import urlparse - net preloop-preloop-ce59a15/backend/preloop/api/ssr.py :4
import httpx - net preloop-preloop-ce59a15/backend/preloop/cra/ci.py :21
import urllib.error - net preloop-preloop-ce59a15/backend/preloop/cra/evidence_pack.py :27
from urllib.parse import urlsplit - net preloop-preloop-ce59a15/backend/preloop/integrations/agent_control/core.py :20
import aiohttp - net preloop-preloop-ce59a15/backend/preloop/models/crud/session_embedding_setting.py :11
import socket - net preloop-preloop-ce59a15/backend/preloop/security/purl_enrich.py :11
from urllib.parse import quote, urlparse - net preloop-preloop-ce59a15/backend/preloop/services/ai_model_pricing.py :16
from urllib.parse import urlparse - net preloop-preloop-ce59a15/backend/preloop/services/ai_model_provider.py :17
from urllib.parse import urlsplit - net preloop-preloop-ce59a15/backend/preloop/services/alibaba_price_catalog.py :24
from urllib.parse import urlparse - net preloop-preloop-ce59a15/backend/preloop/services/alibaba_pricing.py :21
from urllib.parse import urlparse - net preloop-preloop-ce59a15/backend/preloop/services/approval_service.py :10
from urllib.parse import urljoin - net preloop-preloop-ce59a15/backend/preloop/services/audio_model.py :10
from urllib import error as urllib_error - net preloop-preloop-ce59a15/backend/preloop/services/deepseek_pricing.py :14
from urllib.parse import urlsplit - net preloop-preloop-ce59a15/backend/preloop/services/dynamic_fastmcp_http.py :13
from urllib.parse import urlparse - net preloop-preloop-ce59a15/backend/preloop/services/event_webhooks/targets.py :20
import socket - net preloop-preloop-ce59a15/backend/preloop/services/event_webhooks/worker.py :24
import httpx - net preloop-preloop-ce59a15/backend/preloop/services/flow_continuation_adoption.py :8
from urllib.parse import quote, urlparse - net preloop-preloop-ce59a15/backend/preloop/services/flow_environment.py :104
readiness = f"""import socket,time - net preloop-preloop-ce59a15/backend/preloop/services/flow_execution_dispatcher.py :8
import socket - net preloop-preloop-ce59a15/backend/preloop/services/flow_feedback.py :12
from urllib.parse import urlparse - net preloop-preloop-ce59a15/backend/preloop/services/flow_feedback_provider.py :14
from urllib.parse import quote - net preloop-preloop-ce59a15/backend/preloop/services/flow_orchestrator.py :6346
import httpx - net preloop-preloop-ce59a15/backend/preloop/services/flow_pr_binding.py :17
from urllib.parse import urlparse - net preloop-preloop-ce59a15/backend/preloop/services/gateway_error_alerts.py :24
from urllib.parse import urlsplit - net preloop-preloop-ce59a15/backend/preloop/services/instance_service.py :16
import httpx - net preloop-preloop-ce59a15/backend/preloop/services/isolated_publication.py :15
import httpx - net preloop-preloop-ce59a15/backend/preloop/services/issue_lifecycle_provider.py :12
from urllib.parse import urlparse
124 more not shown — this panel samples each group; the count above is the real total.
secrets 35
- secrets preloop-preloop-ce59a15/backend/preloop/agents/checkpoint_client.py :566
request("GET", os.environ["PRELOOP_CHECKPOINT_GET_TOKEN"]), - secrets preloop-preloop-ce59a15/backend/preloop/agents/session_runtime.py :28
token = os.environ.get("PRELOOP_NATIVE_SESSION_GET_TOKEN" if action == "restore" else "PRELOOP_NATIVE_SESSION_PUT_TOKEN") - secrets preloop-preloop-ce59a15/backend/preloop/api/endpoints/issue_compliance.py :132
api_key = os.getenv("OPENAI_API_KEY") - secrets preloop-preloop-ce59a15/backend/preloop/api/endpoints/issue_duplicates.py :218
api_key = os.getenv("OPENAI_API_KEY") - secrets preloop-preloop-ce59a15/backend/preloop/config.py :1443
secret_key = os.getenv("SECRET_KEY") - secrets preloop-preloop-ce59a15/backend/preloop/cra/ci.py :1014
parser.add_argument("--token", default=os.environ.get("PRELOOP_TOKEN")) - secrets preloop-preloop-ce59a15/backend/preloop/services/openai_gateway.py :563
previous_auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN") - secrets preloop-preloop-ce59a15/backend/preloop/services/push_notifications/__init__.py :50
auth_key = os.getenv("APNS_AUTH_KEY") # Direct key content (preferred) - secrets preloop-preloop-ce59a15/backend/preloop/services/push_proxy.py :24
PUSH_PROXY_API_KEY = os.getenv("PUSH_PROXY_API_KEY") - secrets preloop-preloop-ce59a15/backend/preloop/utils/email.py :22
SMTP_PASSWORD = os.getenv("SMTP_PASSWORD", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/conftest.py :29
PRELOOP_API_KEY = os.getenv("PRELOOP_TEST_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_flow_execution.py :55
api_key=os.getenv("OPENAI_API_KEY", "test-key"),
show 23 more
- secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_hermes_onboarding.py :30
PRELOOP_API_KEY = os.getenv("PRELOOP_TEST_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_mcp.py :20
PRELOOP_API_KEY = os.getenv("PRELOOP_TEST_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_proxied_tool_consecutive_calls.py :32
token = os.getenv("PRELOOP_TOKEN") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_tracker_sync.py :81
PRELOOP_API_KEY = os.getenv("PRELOOP_TEST_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_tracker_sync_common.py :20
PRELOOP_API_KEY = os.getenv("PRELOOP_TEST_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_tracker_sync_github.py :45
GITHUB_API_KEY = os.getenv("GITHUB_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_tracker_sync_gitlab.py :47
GITLAB_API_KEY = os.getenv("GITLAB_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_tracker_sync_jira.py :49
JIRA_API_KEY = os.getenv("JIRA_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_ui.py :10
PASSWORD = os.environ.get("PRELOOP_TEST_PASSWORD") - secrets (weak) preloop-preloop-ce59a15/backend/tests/integration/test_ui_e2e.py :19
PASSWORD = os.environ.get("PRELOOP_TEST_PASSWORD") - secrets (weak) preloop-preloop-ce59a15/backend/tests/services/test_openai_gateway.py :363
observed_env["api_key"] = os.environ.get("ANTHROPIC_API_KEY") - secrets (weak) preloop-preloop-ce59a15/scripts/backfill_openrouter_ledger.py :165
api_key = os.environ.get("OPENROUTER_ACTIVITY_KEY", "").strip() - secrets (weak) preloop-preloop-ce59a15/scripts/create_first_user.py :62
default=os.getenv("PRELOOP_ADMIN_PASSWORD", ""), - secrets (weak) preloop-preloop-ce59a15/scripts/e2e-rig/ci_cli_onboard.py :45
TOKEN = os.environ.get("PRELOOP_TEST_API_KEY", "") - secrets (weak) preloop-preloop-ce59a15/scripts/e2e-rig/research_agent.py :660
user_token = os.environ.get("PRELOOP_USER_TOKEN") - secrets (weak) preloop-preloop-ce59a15/scripts/examples/example_mcp_server.py :28
BEARER_TOKEN = os.getenv("BEARER_TOKEN", "test-token-12345") - secrets (weak) preloop-preloop-ce59a15/scripts/init_db.py :240
api_key = os.getenv("OPENAI_API_KEY") - secrets (weak) preloop-preloop-ce59a15/scripts/install_model_price_review.py :151
token = os.getenv("PRELOOP_API_TOKEN", "") - secrets (weak) preloop-preloop-ce59a15/scripts/manual_tests/test_approval_streaming.py :54
bearer_token = os.getenv("PRELOOP_TOKEN") - secrets (weak) preloop-preloop-ce59a15/scripts/manual_tests/test_proxied_approval_streaming.py :54
bearer_token = os.getenv("PRELOOP_TOKEN") - secrets (weak) preloop-preloop-ce59a15/scripts/test_agent_api.py :36
API_TOKEN = os.getenv("PRELOOP_TOKEN", "") - secrets (weak) preloop-preloop-ce59a15/scripts/test_auth.py :9
password = os.environ.get("PRELOOP_PASSWORD") - secrets (weak) preloop-preloop-ce59a15/scripts/test_issue_search.py :12
password = os.environ.get("PRELOOP_PASSWORD")
database 400
- db preloop-preloop-ce59a15/backend/preloop/agents/remote_runner.py :10
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/agents/runner_launch.py :15
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/agents/session_manifest.py :14
import sqlite3 - db preloop-preloop-ce59a15/backend/preloop/api/app.py :23
from sqlalchemy.exc import TimeoutError as SQLAlchemyPoolTimeout - db preloop-preloop-ce59a15/backend/preloop/api/auth/bootstrap.py :15
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/auth/jwt.py :16
from sqlalchemy.exc import TimeoutError as SQLAlchemyPoolTimeout - db preloop-preloop-ce59a15/backend/preloop/api/auth/permissions.py :12
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/auth/router.py :20
from sqlalchemy.exc import IntegrityError, TimeoutError as SQLAlchemyTimeoutError - db preloop-preloop-ce59a15/backend/preloop/api/auth/webauthn_router.py :29
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/common.py :8
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/account.py :21
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/agent_control.py :17
from sqlalchemy.exc import SQLAlchemyError
show 28 more
- db preloop-preloop-ce59a15/backend/preloop/api/endpoints/ai_models.py :17
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/anthropic_gateway.py :8
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/approval_bypass.py :23
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/approval_requests.py :9
from sqlalchemy.ext.asyncio import AsyncSession - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/audio.py :13
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/audit_chain.py :31
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/budget.py :10
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/comments.py :9
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/cost.py :17
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/embedding.py :3
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/event_webhooks.py :30
from sqlalchemy import select - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/exports.py :21
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/features.py :7
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/flow_artifacts.py :10
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/flows.py :8
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/gemini_gateway.py :8
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/health.py :9
from sqlalchemy import text - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/impersonation.py :9
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/issue_compliance.py :10
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/issue_dependencies.py :9
from sqlalchemy.exc import IntegrityError - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/issue_duplicates.py :2
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/issue_lifecycle.py :9
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/issues.py :8
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/kill_switch.py :16
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/mcp.py :26
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/mcp_servers.py :14
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/notification_preferences.py :13
from sqlalchemy.orm import Session - db preloop-preloop-ce59a15/backend/preloop/api/endpoints/openai_gateway.py :9
from sqlalchemy.orm import Session
360 more not shown — this panel samples each group; the count above is the real total.
tool registrations 20
- get_issue_tool preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :143
- create_issue preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :146
- update_issue_tool preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :262
- search preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :265
- estimate_compliance preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :304
- improve_compliance preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :349
- request_approval preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :387
- ask_user preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :594
- permission_prompt preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :785
- send_note_tool preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :958
- resolve_sbom_upstreams preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :966
- run_flow_tool preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1148
show 8 more
- get_execution_tool preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1234
- search_sessions_tool preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1332
- add_comment preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1335
- update_comment preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1387
- get_pull_request preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1439
- update_pull_request preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1482
- create_pull_request preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1555
- get_approval_status preloop-preloop-ce59a15/backend/preloop/services/initialize_mcp.py :1622
declared dependencies 90
- fastmcp@>=3.2.0,<4.0.0
- mcp@>=1.0.0,<2
- anthropic@>=0.72.0
- uvicorn@>=0.36.0
- fastapi@>=0.129.2
- sqlalchemy@>=2.0.0
- greenlet@>=3.0.0
- psycopg@>=3.1.12
- psycopg2-binary@>=2.9.0
- pgvector@>=0.2.0
- pydantic@>=2.4.0
- pydantic-settings@>=2.0.0
show 28 more
- PyJWT@>=2.8.0
- bcrypt@<5.1.0
- python-multipart@>=0.0.6
- Pillow@>=10.0.0
- httpx@>=0.24.1
- tenacity@>=8.2.3
- python-json-logger@>=2.0.0
- jinja2@>=3.1.2
- aiosmtplib@>=2.0.2
- loguru@>=0.7.3
- aiohttp@>=3.9.0
- sentry-sdk@>=2.9.0
- pyinstrument@>=4.6.2
- nats-py@>=2.6.0
- stripe@>=12.4.0
- maxminddb@>=2.6.0
- user-agents@>=2.2.0
- aiodocker@>=0.21.0
- kubernetes_asyncio@>=30.5.0
- cel-python@>=0.1.0
- python-dotenv@>=1.2.1
- alembic@>=1.10.0
- numpy@>=1.24.0
- openai@>=1.75.0
- asyncpg@>=0.29.0
- click@>=8.0.0
- python-gitlab@>=4.0.0
- APScheduler@>=3.0.0
50 more not shown — this panel samples each group; the count above is the real total.
cursor-plugin 1
- opaque (low) preloop-preloop-ce59a15/.cursor/environment.json
bundled .cursor/ plugin descriptor (preloop-preloop-ce59a15/.cursor/environment.json) — presence-detected; review the descriptor
transport_posture 3
- binds all interfaces (0.0.0.0) preloop-preloop-ce59a15/scripts/examples/example_mcp_server.py :363
host="0.0.0.0", - network-listening, binds all interfaces, no auth detected preloop-preloop-ce59a15/scripts/manual_tests/test_basic_progress_server.py :32
mcp.run(transport="streamable-http", host="0.0.0.0", port=8002) - network-listening, binds all interfaces, no auth detected preloop-preloop-ce59a15/scripts/tests/flow_environment_integration.py :184
uvicorn.Config(app, host="0.0.0.0", port=args.port, log_level="error")