MCP Observatory
2m ago Tracked 60,039 Last 2m ago 24h 2,475
github TypeScript analyzed 366bec9

relakeinc/trell

github

The open-source form analytics platform — track form views, submissions & conversions, with funnels, UTM attribution and an MCP server.

maintainer
relakeinc
licence
AGPL-3.0
first seen
2026-09-12
last seen
2026-09-15
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 28 tools
transport stdio · streamable-http · http counts 28 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • add_domain
  • create_api_key
  • create_funnel
  • create_utm_template
  • create_webhook
  • delete_funnel
  • delete_project
  • delete_utm_template
  • delete_webhook
  • get_breakdown
  • get_forms
  • get_funnel
  • get_project
  • get_series
  • get_stats
  • list_api_keys
  • list_funnels
  • list_projects
  • list_utm_templates
  • list_views
  • list_webhooks
  • query_events
  • remove_domain
  • revoke_api_key
  • rotate_project_secret
  • tracking_checkup
  • update_funnel
  • update_utm_template
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 366bec9 · analyzer v33 · 4d ago

danger signals2

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 258

filesystem 7

  • fs relakeinc-trell-366bec9/apps/api/src/app.ts :2 import { readFile } from "node:fs/promises";
  • fs relakeinc-trell-366bec9/apps/api/src/mcp-stdio.ts :1 import { existsSync } from "node:fs";
  • fs (weak) relakeinc-trell-366bec9/apps/api/test/sdk.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) relakeinc-trell-366bec9/apps/web/scripts/e2e.ts :10 import { existsSync, readFileSync, createWriteStream, unlinkSync } from "node:fs";
  • fs (weak) relakeinc-trell-366bec9/scripts/ensure-prod-tunnel.mjs :29 import { existsSync, readFileSync } from "node:fs";
  • fs (weak) relakeinc-trell-366bec9/scripts/generate-icons.mjs :15 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs (weak) relakeinc-trell-366bec9/scripts/generate-pwa-icons.mjs :20 import { mkdirSync, writeFileSync } from "node:fs";

shell / exec 2

  • shell (weak) relakeinc-trell-366bec9/apps/web/scripts/e2e.ts :9 import { spawn, type ChildProcess } from "node:child_process";
  • shell (weak) relakeinc-trell-366bec9/scripts/ensure-prod-tunnel.mjs :28 import { spawn } from "node:child_process";

network 25

  • net relakeinc-trell-366bec9/apps/api/src/index.ts :2 import { createServer } from "node:http";
  • net relakeinc-trell-366bec9/apps/api/src/lib/ssrf.ts :2 import { isIP } from "node:net";
  • net relakeinc-trell-366bec9/apps/api/src/lib/webhook-delivery.ts :193 res = await fetch(currentUrl, {
  • net relakeinc-trell-366bec9/apps/mcp/src/http.ts :2 import type { IncomingMessage, ServerResponse } from "node:http";
  • net (weak) relakeinc-trell-366bec9/apps/mcp/test/http.test.ts :2 import { createServer } from "node:http";
  • net relakeinc-trell-366bec9/apps/web/public/sw.js :58 const network = fetch(request)
  • net (weak) relakeinc-trell-366bec9/apps/web/scripts/e2e.ts :73 const r = await fetch(url, { cache: "no-store" });
  • net relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/_components/ProjectContext.tsx :73 const res = await fetch(`/api/projects/by-slug?slug=${encodeURIComponent(slug)}`);
  • net relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/api/page.tsx :53 fetch(`/api/projects/${project.id}/api-keys`)
  • net relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/billing/plans/page.tsx :86 const res = await fetch("/api/checkout", {
  • net relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/domains/page.tsx :34 const res = await fetch(`/api/projects/${project.id}/domains`, {
  • net relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/tracking/page.tsx :52 const res = await fetch("${INGEST_URL}", {
show 13 more
  • net relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/utm-templates/page.tsx :35 fetch(`/api/projects/${project.id}/utm-templates`)
  • net relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/webhooks/page.tsx :54 fetch(`/api/projects/${project.id}/webhooks`)
  • net relakeinc-trell-366bec9/apps/web/src/app/api/chat/route.ts :105 const res = await fetch(`${args.provider.baseUrl}/chat/completions`, {
  • net relakeinc-trell-366bec9/apps/web/src/app/pricing/page.tsx :52 const res = await fetch("/api/checkout", {
  • net relakeinc-trell-366bec9/apps/web/src/components/ChatWidget.tsx :539 const res = await fetch("/api/chat/command", {
  • net relakeinc-trell-366bec9/apps/web/src/components/CreateProjectModal.tsx :30 const res = await fetch("/api/projects", {
  • net relakeinc-trell-366bec9/apps/web/src/components/OnboardingFlow.tsx :27 const res = await fetch("/api/onboarding", {
  • net relakeinc-trell-366bec9/apps/web/src/components/ProjectSettings.tsx :96 const res = await fetch(`/api/projects/${projectId}`);
  • net relakeinc-trell-366bec9/apps/web/src/components/ProjectSidebar.tsx :71 fetch(`/api/projects/${project.id}`)
  • net relakeinc-trell-366bec9/apps/web/src/lib/apiClient.ts :25 const res = await fetch(url, { headers: { authorization: `Bearer ${sk}` }, cache: "no-store" });
  • net relakeinc-trell-366bec9/apps/web/src/lib/hooks.ts :22 queryFn: () => fetch("/api/projects").then((r) => r.json() as Promise<ProjectsResponse>),
  • net (weak) relakeinc-trell-366bec9/scripts/ensure-prod-tunnel.mjs :30 import net from "node:net";
  • net (weak) relakeinc-trell-366bec9/scripts/generate-icons.mjs :6 * `fetch(new URL("./...", import.meta.url))`, which breaks when the package is

secrets 12

  • secrets relakeinc-trell-366bec9/apps/web/src/app/[slug]/settings/tracking/page.tsx :56 authorization: "Bearer " + process.env.TRELL_SECRET_KEY,
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/chat/command/route.ts :111 const oauthSecret = process.env.MCP_OAUTH_SECRET ?? "";
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/chat/context/route.ts :24 const oauthSecret = process.env.MCP_OAUTH_SECRET ?? "";
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/chat/route.ts :135 const oauthSecret = process.env.MCP_OAUTH_SECRET ?? "";
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/onboarding/route.ts :18 const encKey = process.env.TRELL_ENC_KEY;
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/portal/route.ts :8 accessToken: process.env.POLAR_ACCESS_TOKEN!,
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/projects/[id]/rotate-secret/route.ts :26 const encKey = process.env.TRELL_ENC_KEY;
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/projects/route.ts :28 const encKey = process.env.TRELL_ENC_KEY;
  • secrets relakeinc-trell-366bec9/apps/web/src/app/api/webhooks/polar/route.ts :8 webhookSecret: process.env.POLAR_WEBHOOK_SECRET!,
  • secrets relakeinc-trell-366bec9/apps/web/src/lib/apiClient.ts :10 const encKey = process.env.TRELL_ENC_KEY;
  • secrets relakeinc-trell-366bec9/apps/web/src/lib/auth.ts :22 if (!process.env.AUTH_GOOGLE_ID || !process.env.AUTH_GOOGLE_SECRET) {
  • secrets relakeinc-trell-366bec9/apps/web/src/lib/polar.ts :4 accessToken: process.env.POLAR_ACCESS_TOKEN!,

database 11

  • db (weak) relakeinc-trell-366bec9/apps/api/scripts/seed-events.ts :1 import { PrismaClient } from "@prisma/client";
  • db (weak) relakeinc-trell-366bec9/apps/api/scripts/seed.ts :1 import { PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/api/src/analytics/funnel.ts :1 import type { PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/api/src/app.ts :6 import type { PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/api/src/index.ts :4 import { PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/api/src/mcp-stdio.ts :6 import { PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/api/src/repositories/prisma.ts :1 import { Prisma, PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/api/src/routes/ingest.ts :4 import type { PrismaClient } from "@prisma/client";
  • db (weak) relakeinc-trell-366bec9/apps/web/scripts/e2e.ts :13 import { PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/web/src/lib/authz.ts :1 import type { PrismaClient } from "@prisma/client";
  • db relakeinc-trell-366bec9/apps/web/src/lib/prisma.ts :1 import { PrismaClient } from "@prisma/client";

tool registrations 28

  • list_projects relakeinc-trell-366bec9/apps/mcp/src/server.ts :92
  • get_project relakeinc-trell-366bec9/apps/mcp/src/server.ts :96
  • get_stats relakeinc-trell-366bec9/apps/mcp/src/server.ts :104
  • tracking_checkup relakeinc-trell-366bec9/apps/mcp/src/server.ts :112
  • get_series relakeinc-trell-366bec9/apps/mcp/src/server.ts :120
  • get_breakdown relakeinc-trell-366bec9/apps/mcp/src/server.ts :128
  • get_forms relakeinc-trell-366bec9/apps/mcp/src/server.ts :136
  • query_events relakeinc-trell-366bec9/apps/mcp/src/server.ts :144
  • list_funnels relakeinc-trell-366bec9/apps/mcp/src/server.ts :152
  • get_funnel relakeinc-trell-366bec9/apps/mcp/src/server.ts :156
  • list_views relakeinc-trell-366bec9/apps/mcp/src/server.ts :160
  • list_webhooks relakeinc-trell-366bec9/apps/mcp/src/server.ts :164
show 16 more
  • list_utm_templates relakeinc-trell-366bec9/apps/mcp/src/server.ts :172
  • list_api_keys relakeinc-trell-366bec9/apps/mcp/src/server.ts :176
  • create_funnel relakeinc-trell-366bec9/apps/mcp/src/server.ts :185
  • update_funnel relakeinc-trell-366bec9/apps/mcp/src/server.ts :189
  • delete_funnel relakeinc-trell-366bec9/apps/mcp/src/server.ts :197
  • create_utm_template relakeinc-trell-366bec9/apps/mcp/src/server.ts :201
  • update_utm_template relakeinc-trell-366bec9/apps/mcp/src/server.ts :205
  • delete_utm_template relakeinc-trell-366bec9/apps/mcp/src/server.ts :209
  • add_domain relakeinc-trell-366bec9/apps/mcp/src/server.ts :213
  • remove_domain relakeinc-trell-366bec9/apps/mcp/src/server.ts :221
  • create_webhook relakeinc-trell-366bec9/apps/mcp/src/server.ts :229
  • delete_webhook relakeinc-trell-366bec9/apps/mcp/src/server.ts :237
  • create_api_key relakeinc-trell-366bec9/apps/mcp/src/server.ts :241
  • revoke_api_key relakeinc-trell-366bec9/apps/mcp/src/server.ts :250
  • delete_project relakeinc-trell-366bec9/apps/mcp/src/server.ts :258
  • rotate_project_secret relakeinc-trell-366bec9/apps/mcp/src/server.ts :266

declared dependencies 3

  • prettier@^3.6.2
  • turbo@^2.4.0
  • typescript@^5.7.0

perm:untrusted 1

  • untrusted (weak) relakeinc-trell-366bec9/apps/mcp/test/http.test.ts :123 const meta = await (await fetch(`${url}/.well-known/oauth-protected-resource`)).json();

transport_posture 1

  • binds all interfaces (0.0.0.0) relakeinc-trell-366bec9/apps/api/src/index.ts :42 createServer((req, res) => void listener(req, res)).listen(mcpPort, "0.0.0.0", () => {