github JavaScript re-analysis due deep scan · partial (598/3,980 files)

rexleimo/aios

Local-first AI agent bootstrap: Playwright Browser MCP + ContextDB for Codex CLI, Claude Code, Gemini CLI, and OpenCode.

maintainer: rexleimo
licence: MIT
first seen: 2026-08-10
last seen: 2026-09-19
releases · 30d: 19
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools

transport stdio · streamable-http · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

tools

browser_close
browser_list_tabs

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 3bc020c · analyzer v33 · 9h ago

skills & prompt files 40

danger signals1

credential in logs credential in log rexleimo-aios-3bc020c/scripts/aios-cred.mjs :88 console.log(password);

code evidence vv5.17.4 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1410

filesystem 216

fs (weak) rexleimo-aios-3bc020c/mcp-server/scripts/contextdb-refs-benchmark-gate.ts :2 import { promises as fs } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/mcp-server/scripts/contextdb-refs-benchmark.ts :2 import { promises as fs } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/mcp-server/scripts/with-project-node.mjs :3 import fs from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/browser/actions/screenshot.ts :1 import { promises as fs } from 'fs';
fs rexleimo-aios-3bc020c/mcp-server/src/browser/launcher.ts :3 import * as fs from 'fs';
fs rexleimo-aios-3bc020c/mcp-server/src/browser/profiles.ts :2 import { promises as fs } from 'fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/cli/args.ts :2 import { promises as fs } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/cli/genealogy-api.ts :2 import { promises as fs } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/cli/genealogy-server.ts :4 import { promises as fs } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/cli/output.ts :2 import { promises as fs } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/core.ts :1 import { promises as fs } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/genealogy.ts :1 import { promises as fs } from 'node:fs';

show 28 more

fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/hygiene.ts :1 import { promises as fs } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/paths.ts :1 import { existsSync } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/sqlite/connection.ts :1 import { mkdirSync } from 'node:fs';
fs rexleimo-aios-3bc020c/mcp-server/src/contextdb/sqlite/schema.ts :1 import { existsSync, unlinkSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/mcp-server/tests/contextdb-explain.test.ts :3 import { promises as fs } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/mcp-server/tests/contextdb-hygiene.test.ts :3 import { promises as fs } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/mcp-server/tests/contextdb.test.ts :3 import { promises as fs } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/mcp-server/tests/stealth-detection.test.ts :13 import { existsSync } from 'node:fs';
fs rexleimo-aios-3bc020c/packages/debug-hub/src/storage.ts :1 import { readFile, writeFile, appendFile, mkdir, readdir, unlink, rm } from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/packages/debug-hub/tests/api.test.ts :3 import { mkdtempSync, rmSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/packages/debug-hub/tests/integration.test.ts :3 import { mkdtempSync, rmSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/packages/debug-hub/tests/mcp.test.ts :3 import { mkdtempSync, rmSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/packages/debug-hub/tests/server.test.ts :3 import { mkdtempSync, rmSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/packages/debug-hub/tests/storage.test.ts :3 import { mkdtempSync, rmSync } from 'node:fs';
fs rexleimo-aios-3bc020c/pptx-ai-coding-share/pptxgenjs_helpers/code.js :4 const fs = require("fs");
fs rexleimo-aios-3bc020c/pptx-ai-coding-share/pptxgenjs_helpers/image.js :4 const fs = require("fs");
fs (weak) rexleimo-aios-3bc020c/scripts/aios-init.mjs :3 import { existsSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/scripts/aios-mcp-server.mjs :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1-compare.mjs :2 import { access, copyFile, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1-differential.mjs :3 import { access, copyFile, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1-evidence-gate.mjs :2 import { mkdir, readFile, writeFile } from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1-scale.mjs :2 import { mkdir, mkdtemp, readdir, rm, stat, writeFile } from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1.mjs :3 import { access, appendFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/scripts/build-debug-hub.mjs :3 import { accessSync, constants, copyFileSync, mkdirSync, rmSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/scripts/check-native-sync.mjs :2 import fs from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/scripts/check-node-version.mjs :2 import { readFileSync } from 'node:fs';
fs (weak) rexleimo-aios-3bc020c/scripts/check-site-sync.mjs :1 import fs from 'node:fs/promises';
fs (weak) rexleimo-aios-3bc020c/scripts/check-skills-sync.mjs :2 import fs from 'node:fs/promises';

176 more not shown — this panel samples each group; the count above is the real total.

shell / exec 110

shell (weak) rexleimo-aios-3bc020c/mcp-server/scripts/with-project-node.mjs :2 import { spawnSync } from 'node:child_process';
shell rexleimo-aios-3bc020c/mcp-server/src/contextdb/cli/genealogy-server.ts :3 import { spawn } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/mcp-server/tests/contextdb-explain.test.ts :6 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/mcp-server/tests/contextdb-hygiene.test.ts :6 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/mcp-server/tests/contextdb.test.ts :6 import { spawn, spawnSync } from 'node:child_process';
shell rexleimo-aios-3bc020c/packages/aios-pi/lib/aios-cli.mjs :37 // Accept every module shape: ESM namespace from `import('node:child_process')`
shell rexleimo-aios-3bc020c/packages/debug-hub/src/storage.ts :5 import { execSync } from 'node:child_process';
shell rexleimo-aios-3bc020c/pptx-ai-coding-share/pptxgenjs_helpers/text.js :4 const { spawnSync } = require("child_process");
shell (weak) rexleimo-aios-3bc020c/scripts/aios-cred.mjs :8 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/aios-init.mjs :282 const { execFile } = await import('node:child_process');
shell (weak) rexleimo-aios-3bc020c/scripts/aios-mcp-server.mjs :5 import { execSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1-compare.mjs :1 import { spawnSync } from 'node:child_process';

show 28 more

shell (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1-differential.mjs :2 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/benchmarks/context-lifecycle-v1.mjs :2 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/build-debug-hub.mjs :6 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/aios-init/agent-config.mjs :4 import { execSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/aios-init/compression-tools.mjs :17 import { execSync, spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/cli/dispatch/helpers.mjs :6 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/clients/smoke.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/components/codemap/opencode-plugin.mjs :12 const proc = Bun.spawn(["uvx", "code-review-graph", ...args], {
shell (weak) rexleimo-aios-3bc020c/scripts/lib/contextdb-cli.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/contextdb/shell-bridge/process-runner.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/contextdb/shell-bridge/workspace.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/ctx-agent-core/common.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/doctor/security-config/files.mjs :1 import { execFileSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/harness/solo-worktree.mjs :4 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/integrations/install.mjs :6 import { execFile } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/interception/mcp/stdio-proxy.mjs :2 import { spawn } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/interception/shell/shell-wrapper.mjs :2 import { spawn } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/lifecycle/context-reconciliation.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/lifecycle/self-update.mjs :4 import { spawn } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/lifecycle/update.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/lifecycle/watchdog/signals.mjs :2 import { execFileSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/memo/cli/gui.mjs :1 import { spawn } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/pi/rpc-client.mjs :8 // pi.cmd, and a raw spawn('pi') fails there with ENOENT while every other
shell (weak) rexleimo-aios-3bc020c/scripts/lib/planning/plan-runtime.mjs :6 import { execFileSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/platform/process/spawn.mjs :2 import { spawn, spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/rl-shell-v1/real-task-registry.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/rl-shell-v1/task-registry.mjs :3 import { spawnSync } from 'node:child_process';
shell (weak) rexleimo-aios-3bc020c/scripts/lib/rl-shell-v1/temp-runner/command.mjs :2 import { spawnSync } from 'node:child_process';

70 more not shown — this panel samples each group; the count above is the real total.

network 12

net rexleimo-aios-3bc020c/mcp-server/src/contextdb/cli/genealogy-api.ts :3 import type http from 'node:http';
net rexleimo-aios-3bc020c/mcp-server/src/contextdb/cli/genealogy-server.ts :2 import http from 'node:http';
net (weak) rexleimo-aios-3bc020c/mcp-server/tests/contextdb.test.ts :311 const allowedFile = await fetch(`${server.url}/api/file?workspace=${encodeURIComponent(workspace)}&project=demo&file=docs%2Fallowed.md`);
net rexleimo-aios-3bc020c/packages/debug-hub/sdk/browser/src/client.ts :11 await fetch(`${this.endpoint}/api/logs/single`, {
net rexleimo-aios-3bc020c/packages/debug-hub/sdk/node/src/client.ts :11 const res = await fetch(`${this.endpoint}/api/logs/single`, {
net rexleimo-aios-3bc020c/packages/debug-hub/src/api.ts :1 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
net (weak) rexleimo-aios-3bc020c/packages/debug-hub/tests/api.test.ts :46 const res = await fetch(`${baseUrl}/api/logs/single`, {
net (weak) rexleimo-aios-3bc020c/packages/debug-hub/tests/integration.test.ts :55 const res = await fetch(`${baseUrl}/api/logs/single`, {
net (weak) rexleimo-aios-3bc020c/scripts/indexnow-submit.mjs :20 const response = await fetch(sitemapUrl, { headers: { 'cache-control': 'no-cache' } });
net (weak) rexleimo-aios-3bc020c/scripts/lib/components/browser/cdp-service.mjs :2 import net from 'node:net';
net (weak) rexleimo-aios-3bc020c/scripts/lib/privacy-guard/redaction.mjs :157 response = await fetch(endpoint, {
net (weak) rexleimo-aios-3bc020c/skill-sources/rexai-image-generation/scripts/rexai-image.mjs :124 const response = await fetch(url, init);

secrets 4

secrets rexleimo-aios-3bc020c/mcp-server/dist/index.js :250 const token = String(process.env.MCP_HTTP_TOKEN || '').trim();
secrets rexleimo-aios-3bc020c/mcp-server/src/index.ts :272 const token = String(process.env.MCP_HTTP_TOKEN || '').trim();
secrets (weak) rexleimo-aios-3bc020c/scripts/tests/judgment.test.mjs :535 const savedKey = process.env.TYPESAFE_API_KEY;
secrets (weak) rexleimo-aios-3bc020c/skill-sources/rexai-image-generation/scripts/rexai-image.mjs :26 apiKey: process.env.REXAI_API_KEY || '',

tool registrations 4

browser_close rexleimo-aios-3bc020c/mcp-server/dist/index.js :187
browser_list_tabs rexleimo-aios-3bc020c/mcp-server/dist/index.js :197
browser_close rexleimo-aios-3bc020c/mcp-server/src/index.ts :204
browser_list_tabs rexleimo-aios-3bc020c/mcp-server/src/index.ts :214

declared dependencies 10

@modelcontextprotocol/sdk@^1.29.0
@inkjs/ui@^1.0.0
@inquirer/prompts@^8.4.3
chalk@^5.6.2
commander@^14.0.3
ink@^4.4.1
react@^18.3.1
react-router@^7.1.1
yaml@^2.9.0
tsx@^4.21.0

obfuscation 1

dynamic require()/import() rexleimo-aios-3bc020c/pptx-ai-coding-share/pptxgenjs_helpers/code.js :42 require(`prismjs/components/prism-${id}`);