github Rust analyzed d510813

runyourempire/victauri

github

Full-stack testing for Tauri apps — DOM, IPC, Rust backend, and database from one test. 28 MCP tools. Zero production cost.

maintainer
runyourempire
licence
Apache-2.0
first seen
2026-06-04
last seen
2026-06-20
releases · 30d
0
short id

runyourempire/victauri is an MCP server distributed on github, maintained by runyourempire, tracked here since June 2026. It has shipped 27 releases and exposes 20 tools. Tools include app_info, app_state, assert_semantic, check_ipc_integrity, detect_ghost_commands, dom_snapshot, and 14 more. Its composite risk grade is C — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised 4 review prompts — dangerous code, exfiltration combo, purpose mismatch and tool shadowing — each a pattern worth a human look rather than a finding of fault.

Its 20 tools appear to reach filesystem, shell / exec, network and database, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →
tools 20
  • app_info App config, directory paths, env vars, discovered databases, process info
  • app_state Read app-defined backend-state probes (pipeline/queue/cache internals) — no IPC round-trip
  • assert_semantic Evaluate JS + assert against expected value
  • check_ipc_integrity Detect stuck/stale/errored IPC calls
  • detect_ghost_commands Find orphaned frontend IPC calls (high-confidence confirmed_ghosts)
  • dom_snapshot Full accessibility tree with ref handles
  • eval_js Execute JavaScript in the webview
  • find_elements Search by text, role, test ID, CSS, label, placeholder, alt, title
  • get_diagnostics Shadow DOM, service workers, iframes, large DOM detection
  • get_memory_stats Real-time OS process memory (working set, page faults)
  • get_plugin_info Plugin config: port, tools, privacy, version
  • get_registry List all #[inspectable] command schemas
  • invoke_command Call any Tauri command directly through IPC
  • list_app_dir Browse files in app data/config/log/local_data directories
  • query_db Read-only SQLite queries with auto-discovery
  • read_app_file Read files from app backend directories (UTF-8 or base64)
  • resolve_command Natural language to matching Tauri command
  • screenshot Platform-native window capture (no Chromium)
  • verify_state Compare frontend DOM against backend state
  • wait_for Poll for conditions: text, selector, IPC settle, JS expression, or Tauri event — await async backend work without sleeps
release cadence · 90d 5 releases
06-14 00:00 07-28 00:00 now
recent releases last 10
version date src
v0.8.4 2026-06-19 github
v0.8.3 2026-06-16 github
v0.8.2 2026-06-14 github
v0.8.1 2026-06-14 github
v0.8.0 2026-06-13 github
v0.7.11 2026-06-08 github
v0.7.10 2026-06-08 github
v0.7.9 2026-06-06 github
v0.7.8 2026-06-05 github
v0.7.7 2026-06-05 github

view all →