The open-source AI agent control plane: MCP firewall, model gateway with budgets, human approvals, runtime observability, and audit trails
- capability exposure inferred + 35
- tool safety inferred + 17
- trust mitigators mixed − 8
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
- C · 49 → C · 44
- D · 69 → C · 49
- D · 62 → D · 69
- C · 57 → D · 62
- C · 49 → C · 57
- C · 40 → C · 49
- C · 47 → C · 40
- A · 0 → C · 47
No known CVEs for this server.
- high dangerous code
committed secret: GitHub fine-grained PAT, GitLab token, Anthropic key, Google API key · dynamic exec: eval()/exec()
- medium toxic flow (lethal trifecta)
lethal trifecta reachable across this server's tool + source surface: private-data access + untrusted-content ingestion + network exfil (a leg is proven only in the analyzed source)
- low dangerous code
env-secret-flows-to-network-py: An environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a key, call
- low dangerous code
env-secret-flows-to-network-py: An environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a key, call
- low dangerous code
env-secret-flows-to-network-py: An environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a key, call
analyzed commit ce59a15 · analyzer v33 · 1h ago
skills & prompt files 1
- agent-rules preloop-preloop-ce59a15/AGENTS.md
danger signals24
- dynamic code execution eval()/exec() preloop-preloop-ce59a15/backend/preloop/services/dynamic_fastmcp.py :1165
exec(wrapper_code, namespace) - dynamic code execution eval()/exec() preloop-preloop-ce59a15/backend/tests/services/test_db_pool_hold_diagnostics.py :166
exec( - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/api/test_event_webhooks.py :370
json={"url": "https://169.254.169.254/latest/meta-data", "event_types": []}, - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/endpoints/test_ai_models.py :396
api_endpoint="http://169.254.169.254/latest/meta-data", - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/models/test_session_embedding_setting_crud.py :89
({"base_url": "https://169.254.169.254/latest"}, "invalid_base_url"), - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/services/event_webhooks/test_targets.py :26
("https://169.254.169.254/latest/meta-data", "link-local"), - suspicious endpoint 169.254.169.254 (cloud metadata) preloop-preloop-ce59a15/backend/tests/services/test_ai_model_provider.py :1703
"http://169.254.169.254/latest/meta-data", - suspicious endpoint 1.2.3.4 preloop-preloop-ce59a15/backend/tests/services/test_ai_model_provider.py :1756
"https://1.2.3.4/v1", - suspicious endpoint otlp.datadoghq.com (telemetry) preloop-preloop-ce59a15/backend/tests/services/test_otel_export.py :233
"https://otlp.datadoghq.com/v1/traces", "http/protobuf", "traces" - over-broad OAuth scope admin:org preloop-preloop-ce59a15/backend/preloop/sync/trackers/github.py :571
for scope in ["admin:org_hook", "admin:org", "write:org_hook"] - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/agents/test_agent_openhands.py :321
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/agents/test_container.py :1208
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/cra/test_persist.py :408
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/endpoints/test_runners_helpers.py :352
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/models/crud/test_flow_execution_log_scrubbing.py :16
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_flow_execution_logger.py :452
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_flow_orchestrator_git_credentials.py :18
github…(57 chars, redacted) - committed secret GitLab token preloop-preloop-ce59a15/backend/tests/services/test_follow_up_filing.py :48
glpat-…(26 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_log_persistence_backpressure.py :148
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/services/test_tracker_git_token.py :20
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/utils/test_git_credentials.py :30
github…(57 chars, redacted) - committed secret GitHub fine-grained PAT preloop-preloop-ce59a15/backend/tests/utils/test_secret_scrubbing.py :18
github…(57 chars, redacted) - committed secret Anthropic key preloop-preloop-ce59a15/backend/tests/utils/test_secret_scrubbing.py :99
sk-ant…(39 chars, redacted) - committed secret Google API key preloop-preloop-ce59a15/backend/tests/utils/test_secret_scrubbing.py :232
AIzaSy…(39 chars, redacted)
[](https://mcpobservatory.com/servers/github:preloop/preloop/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of preloop.